Re: Martin Stiemerling's No Objection on draft-ietf-6man-stable-privacy-addresses-16: (with COMMENT)

[Martin Stiemerling <[e-mail]>]

Hi Fernando,

On 01/20/2014 11:43 AM, Fernando Gont wrote:
> Hi, Martin,
>
> Thanks so much for your review! Please find my comments in-line...
>
>
> On 01/20/2014 07:10 AM, Martin Stiemerling wrote:
>> ----------------------------------------------------------------------
>> COMMENT:
>> ----------------------------------------------------------------------
>>
>> Section 2., paragraph 4:
>>
>>>     Note that the result of F() in the algorithm above is no more
>> secure
>>>     than the secret key.  If an attacker is aware of the PRF that is
>>>     being used by the victim (which we should expect), and the attacker
>>>     can obtain enough material (i.e. addresses configured by the
>> victim),
>>>     the attacker may simply search the entire secret-key space to find
>>>     matches.  To protect against this, the secret key should be of a
>>>     reasonable length.  Key lengths of at least 128 bits should be
>>>     adequate.  The secret key is initialized at system installation
>> time
>>>     to a pseudo-random number, thus allowing this mechanism to be
>> enabled
>>>     /used automatically, without user intervention.
>>
>>    Isn't there a requirement (MUST) or at least a recommendation
>> (RECOMMENDED) to say something about the minimum length of the secret
>> key? Just to let implementers know from what length on the secret is
>> 'safe' as input?
>
> I think we could change:
>
>   "To protect against this, the secret key should be of a
>    reasonable length.  Key lengths of at least 128 bits should be
>    adequate."
>
> to:
>
>   "To protect against this, the secret key SHOULD be of at least
>    128 bits."
>
>
> However, this is intertwined with the choice of F(), which we're not
> specifying (since it represents a tradeoff). So, while I see your point,
> I'm not sure whether that would make sense.

I'm also torn, but I would add a minimum recommendation, so that 
implementers have a lower limit to start from. Your text proposal is 
good and better than 'reasonable length'.

Thanks,

   Martin

>
> Thoughts?
>
> Thanks!
>
> Best regards,
>