Re: [Lake] Discussion on IoT AEAD limits for AES_128_CCM_8

[Tero Kivinen <[e-mail]>]

Martin Thomson writes:
> You might find this tool useful in evaluating this:
> 
> https://chris-wood.github.io/interactive-aead-limits/
> 
> Note that with the value of p that TLS uses (2^-57), this cipher
> performs very badly.  The number of forgery attempts you can
> tolerate is 128.  That's not 2^128, it's 128.  I don't think that is
> acceptable.  You might be able to increase your tolerance for attack
> (p) to get something more realistic. 

Also note, that the for example in IEEE 802.15.4 the maximum number of
messages which can be sent by one key is 2^32 messages, as the frame
counter is 32-bit counter, and when it reaches 0xffffffff the sending
of frames will fail.

When using TSCH the ASN is 40-bit incrementing timestamp, which
usually increments every 10 ms or so, meaning that for it to wrap
around it takes 348 years.

So the max q is 2^32 for 802.15.4 (or 2^40 if TCSH is used). I would
expect most of the other environments where lake is used will have
similar very small values of max q.

If I understood how the interactive tool works, then if I set p to 51
that would give log2(q) of 32 for message lengths of less than 256
bytes, but that gets log2(v) to quite low of 12.8.

On the other hand p of 32 and setting log2(q) to 33 will give log2(v)
of 32 for 256 byte messages.

So for AES_128_CCM_8 using p of 2^-32 allows sending max number of
messages for IEEE 802.15.4.
-- 
[e-mail]