IETF Logo Mail Archive

[Ntp] Re: Wrong NTS key exporter context in use for AES-128-GCM-SIV

Sanjeev Gupta <ghane0@gmail.com> Mon, 16 September 2024 10:30 UTC

Return-Path: <ghane0@gmail.com>
X-Original-To: ntp@ietfa.amsl.com
Delivered-To: ntp@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 573EDC1516E1 for <ntp@ietfa.amsl.com>; Mon, 16 Sep 2024 03:30:52 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.858
X-Spam-Level:
X-Spam-Status: No, score=-6.858 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KO4hVt9z0k4T for <ntp@ietfa.amsl.com>; Mon, 16 Sep 2024 03:30:51 -0700 (PDT)
Received: from mail-oa1-x29.google.com (mail-oa1-x29.google.com [IPv6:2001:4860:4864:20::29]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EA5BFC14F60D for <ntp@ietf.org>; Mon, 16 Sep 2024 03:30:51 -0700 (PDT)
Received: by mail-oa1-x29.google.com with SMTP id 586e51a60fabf-277dd761926so1811448fac.2 for <ntp@ietf.org>; Mon, 16 Sep 2024 03:30:51 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1726482651; x=1727087451; darn=ietf.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=nrLUm5BAqW7o5pN+cJmUd+LkGYT8ILyc9AZLAdw7QB8=; b=h0ykBGasf9Hafc95xcCA8bEFQ5asqikHMfFMco7GaLSE+MAqeWbdcLsRxdC+W9kNj9 Iis5lDnr2RhiXDt4hkAB3TgDppKiV+ew8Ee3CbabqhhSS77nXcV9lShiBMg+pqK7D1LA MabEL/Zrzo7zhOucPJ8cKQ+gVJ2/qBLUq+81BBuatM+TayCdh/g+QyZ75N8zjnSXX62Z bQ0FZx/L2jKNkvBoBAF6BTwPZChCoCEcKB+ANu0wgrCEPLOiInNRzMxI6lpJ9s5uycDe C7baxcXsWBAv8N9RVfiFCqIm847DIRZfiQXQPHwTGTLhN9MwAVpHuRASaGfkmExGVaj6 sYsg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1726482651; x=1727087451; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=nrLUm5BAqW7o5pN+cJmUd+LkGYT8ILyc9AZLAdw7QB8=; b=JcuUsb3g7lLUb09FGTnO7MCuXuZUIGQMUdQw4ECFcXy8mY+QsbS8XSh1QN8JxEKEAi /Sopb3BqgyMBzV9tu5HF+cK8FbWMyRwHrPpiLC6zQd7/n69ISiwe2E2E9OepJpZ/d1Oq 7rfpR6k5nYyMA+oPHpHrXQDqKmlCDMrf1sub1183gdr/lH6eowzqi5BSxs52mcCi5GvF rn8Z1CTaVPw41q5yIWbScrJR156xZto3ULTRXjaAQhk5Sq7nBa0xnob8w194Tl1Hnbme g4nA+j8NpkWNKV6AhT2RpENMf2jTNlA/f02NMA82P01spR97ddaXraTttKE3yKsfh4O0 H8tg==
X-Gm-Message-State: AOJu0YzmbuxQIruy+fIZXftFi0ipgBGph3/5BjjBTh0CkTZPDfrxE+XQ +91ljsePFffVOjHLaJo4KNzxcV16bAS2c5aZaMxAhtrvUCq+IQ9og1Ea76xx0iTDcMjjK/5YHxC Jrq6gyGUbeZqoDHBy3f519FnjJQqjxA==
X-Google-Smtp-Source: AGHT+IEkSeuj6uCg5iROHn1uqbA+y2WDBvIAqIKAm08inXZy8jyE3pefNepjd/4C0WncI246/EvleSP2s1EnYAq8Zyw=
X-Received: by 2002:a05:6871:51df:b0:261:f8e:a37a with SMTP id 586e51a60fabf-27c6893a769mr5266965fac.14.1726482651099; Mon, 16 Sep 2024 03:30:51 -0700 (PDT)
MIME-Version: 1.0
References: <Zuft30p5rxdjn50i@localhost>
In-Reply-To: <Zuft30p5rxdjn50i@localhost>
From: Sanjeev Gupta <ghane0@gmail.com>
Date: Mon, 16 Sep 2024 18:30:39 +0800
Message-ID: <CAHZk5Weka11wp7V+x2vC-wp52nk+VzxRbf3E-WM6Zisq9OPb6g@mail.gmail.com>
To: Miroslav Lichvar <mlichvar@redhat.com>
Content-Type: multipart/alternative; boundary="000000000000213c2b06223a114f"
Message-ID-Hash: OC6EVK2G4TRPU36A75LL47QAPUAI6QI6
X-Message-ID-Hash: OC6EVK2G4TRPU36A75LL47QAPUAI6QI6
X-MailFrom: ghane0@gmail.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-ntp.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: ntp@ietf.org
X-Mailman-Version: 3.3.9rc4
Precedence: list
Subject: [Ntp] Re: Wrong NTS key exporter context in use for AES-128-GCM-SIV
List-Id: Network Time Protocol <ntp.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/ntp/arNMW97K4HzTdm3a6e8QHTraTYo>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ntp>
List-Help: <mailto:ntp-request@ietf.org?subject=help>
List-Owner: <mailto:ntp-owner@ietf.org>
List-Post: <mailto:ntp@ietf.org>
List-Subscribe: <mailto:ntp-join@ietf.org>
List-Unsubscribe: <mailto:ntp-leave@ietf.org>

On Mon, 16 Sept 2024 at 16:36, Miroslav Lichvar <mlichvar@redhat.com> wrote:

<snip>


> It seems there is no other NTS implementation that added support for
> AES-128-GCM-SIV yet. When that happens, it will not inteoperate with
> the current clients and servers. I think the developers will quickly
> realize that.
>

So what are other NTS clients/servers using?

What if you added that support, prioritised that in new versions released,
and waited?  New servers and clients would interoperate with other
implementations.

At some point(TM) you can correct the AES-128-GCM-SIV implementation.
During this time:


   - New client - New server : works
   - Old client - New server : works
   - New client - other server : works,

etc.

Does this make sense?  No need for a Flag Day, and both changes are in your
control wrt when you wish.
- -
Sanjeev

v2.27.6 | Report a Bug | By Email | System Status