Re: [ntpwg] Minor correction on draft-aanchal4-ntp-mac

Aanchal Malhotra <aanchal4@bu.edu> Wed, 03 May 2017 03:39 UTC

MIME-Version: 1.0
In-Reply-To: <470ea3aa53404dd3a5aa0b3c258786ba@XCH-RTP-006.cisco.com>
References: <de8a5f5cd26c47de864f8efa536b6767@XCH-RTP-006.cisco.com> <CAMbs7ktepdNmKQ1hg+XqVSN3+X63H5WDQbFT3t2eL7zC8Je5sA@mail.gmail.com> <470ea3aa53404dd3a5aa0b3c258786ba@XCH-RTP-006.cisco.com>
From: Aanchal Malhotra <aanchal4@bu.edu>
Date: Tue, 02 May 2017 23:36:27 -0400
Message-ID: <CAMbs7ks=aXgOCL4v=dy9ZhULBLFZb4KxQS1qfSH2eV8FLLOKrQ@mail.gmail.com>
To: "Scott Fluhrer (sfluhrer)" <sfluhrer@cisco.com>
Subject: Re: [ntpwg] Minor correction on draft-aanchal4-ntp-mac
Precedence: list
Cc: "ntpwg@lists.ntp.org" <ntpwg@lists.ntp.org>
Content-Type: multipart/mixed; boundary="===============4761358262152133936=="
Errors-To: ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org
Sender: ntpwg <ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org>

Hi Scott,

On Tue, May 2, 2017 at 11:22 PM, Scott Fluhrer (sfluhrer) <
sfluhrer@cisco.com> wrote:

> To be precise, you don’t actually recover any keying material.  What you
> do recover are the (r, s) values corresponding to the nonce (which is
> enough for an attacker to forge with that nonce).
>

You are right. And that's exactly what I meant by Poly1305 key.

Precisely, pair (r,s) is 32-byte unique (corresponding to nonce) key for
"Poly1305". r may be a constant value but s should be unique, given the
nonce is unique for the same key. However, when s repeats (given the same k
and repeated nonce), for two different messages the pair (r,s) is
recoverable. And so the attacker can forge with that nonce.

>
>
> *From:* Aanchal Malhotra [mailto:aanchal4@bu.edu]
> *Sent:* Tuesday, May 02, 2017 5:08 PM
> *To:* Scott Fluhrer (sfluhrer)
> *Cc:* ntpwg@lists.ntp.org
> *Subject:* Re: [ntpwg] Minor correction on draft-aanchal4-ntp-mac
>
>
>
> Hi Scott,
>
> Thanks for pointing this out. I agree that if nonce is reused even once to
> MAC two different messages with the same key, Poly1305 key can be
> recovered. I will update the draft-aanchal4-ntp-mac.
>
> However, the final MAC-for-NTP recommendation is in this draft
> <https://tools.ietf.org/html/draft-ietf-ntp-mac-00> (which does not
> contain this block of text.)
>
> Thanks,
>
> Aanchal.
>
>
>
> On Fri, Apr 28, 2017 at 3:12 PM, Scott Fluhrer (sfluhrer) <
> sfluhrer@cisco.com> wrote:
>
> The draft claims that
>
>
>
> 2.  The other three algorithms evaluated here do not suffer from
>
>        nonce reuse vulnerabilities where an adversary can recover the
>
>        authentication key if the nonce is reused just once.
>
>
>
> Actually, this is not true; if you use the same nonce to MAC two different
> messages with Poly1305(ChaCha20) (specifically, the RFC7539 version), an
> attacker will be able to forge (just with that nonce, however since the
> attacker gets to select the nonce, that doesn’t help much).
>
>
>
> Now, this doesn’t change the conclusion of the draft, which is to use CMAC
> (which I agree with); I just wanted to make sure that, should you
> reevaluate things and reconsider Poly1305, that you would be aware of the
> issues.
>
>
> _______________________________________________
> ntpwg mailing list
> ntpwg@lists.ntp.org
> http://lists.ntp.org/listinfo/ntpwg
>
>
>

_______________________________________________
ntpwg mailing list
ntpwg@lists.ntp.org
http://lists.ntp.org/listinfo/ntpwg

[ntpwg] Minor correction on draft-aanchal4-ntp-mac Scott Fluhrer (sfluhrer)
Re: [ntpwg] Minor correction on draft-aanchal4-nt… Aanchal Malhotra
Re: [ntpwg] Minor correction on draft-aanchal4-nt… Scott Fluhrer (sfluhrer)
Re: [ntpwg] Minor correction on draft-aanchal4-nt… Aanchal Malhotra
Re: [ntpwg] Minor correction on draft-aanchal4-nt… Danny Mayer