Re: [Lake] Ways forward on MTI cipher suite text

[Michael Richardson <[e-mail]>]

John Mattsson <[e-mail]> wrote:
    >> So what do these extra 8 bytes actually do?

    > 8 byte tags provide 64-bit security against online brute force
    > attacks. 16 byte tags provides 128-bit security against offline brute
    > force attacks.

Brute force attacks against the integrity key, or brute force attacks to
change that specific packet?

    > To break 64-bit security against online brute force an
    > attacker would on average have to send 4.3 billion messages per second
    > for 68 years, which is infeasible in constrained IoT radio
    > technologies.

Agreed, if you are doing an online attack with the responder being your
oracle.   I don't know how to do this in an offline mode because of way that
we use the integrity key.

    > A forgery against a 64-bit MAC in EDHOC breaks the
    > security of all future application data, while a forgery against a
    > 64-bit MAC in the subsequent application protocol (e.g., OSCORE
    > typically only breaks the security of the data in the forged packet.

Agreed.  I'm trying to understand what the extra 8 bytes gives anyone.
I'm just not convinced that it is ever worth it, and that the people who
think that it gives more "security" are not actually thinking things through.

    > - For most MAC algorithms, a forgery only breaks the security of that
    > single packet and the complexity of key recovery is equal to the key
    > length. For GCM, the complexity of authentication key recovery is equal
    > to the tag length. But the complexities of multi-forgeries for most
    > other MAC algorithms are not well understood.

This is the attack I'm talking about.

    > - If the MAC length is not integrity protected and the receiver accepts
    > different length, an attacker can perform forgeries on 32 bit MAC even
    > if the sender only uses 128 bit MACs.

That's silly, that means that the algorithm selection was ignored by the receiver.
Yes, there are people out there who think that receivers will process any
algorithm in the IANA registry.  Really.  I've met them.  It makes a slight
bit of sense when processing *certificates*, but no sense when we have an
AKE.




--
Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide