Re: [kitten] Question about AES mode in Kerberos

[Greg Hudson <[e-mail]>]

On 1/6/23 09:48, Olga Kornievskaia wrote:
> I know you can't speak for them but what are the chances that MIT's
> implementation would support it as well.
Speaking for MIT krb5, I have several concerns about this direction:

* The motivation appears to be performance, but meaningful performance 
gains have not been demonstrated in the context of a GSS application.

* GCM is a fragile encryption mode; any mistakes in the nonce input 
would lead to a catastrophic security vulnerability.

* This work creates an enctype unsuitable for general use, but which 
would require an entry in the IANA enctypes registry to be negotiable 
with RFC 4537.  Putting algorithms with very different security 
properties registered in the same registry has proven to lead to 
security issues (such as CVE-2010-1324).

* The enctype can't fit within the RFC 3961 framework (I believe) 
because it requires nonce information from an upper layer.

* Microsoft's reason for interest ("something [...] for post-sha256") 
doesn't seem to match up with a GSS-only enctype.

A general-purpose enctype using AES-GCM-SIV (RFC 8452) and random nonces 
would be a better fit for Kerberos, but I don't see a good reason to 
specify it unless compelling performance gains can be demonstrated.