Re: Martin Stiemerling's No Objection on draft-ietf-6man-stable-privacy-addresses-16: (with COMMENT)

[Fernando Gont <[e-mail]>]

Hi, Martin,

Thanks so much for your review! Please find my comments in-line...


On 01/20/2014 07:10 AM, Martin Stiemerling wrote:
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
> 
> Section 2., paragraph 4:
> 
>>    Note that the result of F() in the algorithm above is no more
> secure
>>    than the secret key.  If an attacker is aware of the PRF that is
>>    being used by the victim (which we should expect), and the attacker
>>    can obtain enough material (i.e. addresses configured by the
> victim),
>>    the attacker may simply search the entire secret-key space to find
>>    matches.  To protect against this, the secret key should be of a
>>    reasonable length.  Key lengths of at least 128 bits should be
>>    adequate.  The secret key is initialized at system installation
> time
>>    to a pseudo-random number, thus allowing this mechanism to be
> enabled
>>    /used automatically, without user intervention.
> 
>   Isn't there a requirement (MUST) or at least a recommendation
> (RECOMMENDED) to say something about the minimum length of the secret
> key? Just to let implementers know from what length on the secret is
> 'safe' as input?

I think we could change:

 "To protect against this, the secret key should be of a
  reasonable length.  Key lengths of at least 128 bits should be
  adequate."

to:

 "To protect against this, the secret key SHOULD be of at least
  128 bits."


However, this is intertwined with the choice of F(), which we're not
specifying (since it represents a tradeoff). So, while I see your point,
I'm not sure whether that would make sense.

Thoughts?

Thanks!

Best regards,
-- 
Fernando Gont
e-mail: [e-mail] || [e-mail]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1