Re: [Perc] Magnus Westerlund's Discuss on draft-ietf-perc-private-media-framework-10: (with DISCUSS and COMMENT)

[Magnus Westerlund <[e-mail]>]

On 2019-05-17 20:24, Cullen Jennings wrote:


On May 17, 2019, at 8:22 AM, Magnus Westerlund <[e-mail]<mailto:[e-mail]>> wrote:

 So far only a single SRTP cipher suits defined provides source authentication properties that allow an endpoint to cryptographically assert that it sent a particular E2E protected packet. Instead, the common property is that one can determine only that any endpoint that has received the KEK has produced the packet.

Magnus, I’m just a bit confused on what the above two senses are trying to say - can you just expand it out a bit more so I get it. I think I am struggling with what cipher you refer to in the first sentense.


The single SRTP cipher suit that exists that provides any stronger source authentication property than, one of those that have the key has generated this message, is to my knowledge TESLA (RFC  4383).

Let me cite one paragraph from Section 3.1 of RFC 7201:

   The source authentication guarantees provided by SRTP depend on the
   cryptographic transform and key management used.  Some transforms
   give strong source authentication even in multiparty sessions; others
   give weaker guarantees and can authenticate group membership but not
   sources.  Timed Efficient Stream Loss-Tolerant Authentication (TESLA)
   [RFC4383] offers a complement to the regular symmetric keyed
   authentication transforms, like HMAC-SHA-1, and can provide
   per-source authentication in some group communication scenarios.  The
   downside is the need for buffering the packets for a while before
   authenticity can be verified.

So as DOUBLE is AES-GCM which falls into the symmetric cipher suits, or cryptographic transform as I think SRTP actually calls it, the only source authentication provided is that who ever generated the packet has the key. If one have the KEK, one will also receive all endpoints used master key and can derive the actual used key that protects the inner payload and generates the integrity tag. Thus, unless the involved parties has been compromised, the source authentication statement provide is: Someone that was given the KEK has generated this inner protected packet.

You are welcome to formulate this property however you want that you think makes sense.

Cheers

Magnus Westerlund

----------------------------------------------------------------------
Network Architecture & Protocols, Ericsson Research
----------------------------------------------------------------------
Ericsson AB                 | Phone  [phone]
Torshamnsgatan 23           | Mobile [phone]
SE-164 80 Stockholm, Sweden | mailto: [e-mail]<mailto:[e-mail]>
----------------------------------------------------------------------