Re: [saag] PQC in ZRTP (RFC6189) and hybrid KEM

[Eric Rescorla <[e-mail]>]

On Tue, Nov 23, 2021 at 4:55 AM Hannes Tschofenig <[e-mail]>
wrote:

> Ben,
>
>
>
> this shows that even IETF experts have a hard time differentiating IETF
> consensus documents from those who aren’t.
>
> I wonder how often people believed that ZRTP was the product of an IETF
> working group.
>
>
>
> A few years have passed since the publication of ZRTP and attacker
> capabilities have changed. I am wondering whether the security model of
> ZRTP is still meaningful today.
>

I think at this point we have fairly strong evidence that of in-band
confirmation of SAS codes is fairly subject to impersonation via modern
voice synthesis techniques.

See: https://www.rfc-editor.org/rfc/rfc8826.html#section-4.3.2.2

-Ekr


>
> Ciao
>
> Hannes
>
>
>
>
>
> *From:* saag <[e-mail]> *On Behalf Of * Eric Rescorla
> *Sent:* Tuesday, November 23, 2021 1:16 PM
> *To:* Benjamin Kaduk <[e-mail]>
> *Cc:* IETF SAAG <[e-mail]>
> *Subject:* Re: [saag] PQC in ZRTP (RFC6189) and hybrid KEM
>
>
>
>
>
>
>
> On Mon, Nov 22, 2021 at 10:27 PM Benjamin Kaduk <[e-mail]> wrote:
>
> On Mon, Nov 22, 2021 at 09:47:46PM -0800, Eric Rescorla wrote:
> > On Mon, Nov 22, 2021 at 9:28 AM Johan Pascal <[e-mail]>
> > wrote:
> >
> > > Hi,
> > >
> > > thanks for your suggestions. I know the work on hybrid design is
> already
> > > done in TLS and others . While looking for some documentation on that
> > > specific problem I found several protocols addressing it, each of them
> with
> > > specific details related to the protocol and that is mainly what led
> me to
> > > think that a document dedicated to hybrid scheme might make sense: it
> would
> > > save the next person trying to achieve exactly what I'm trying to do
> for
> > > ZRTP the work of reading the different specifications, parting what is
> > > protocol related and what is not. But the hybrid mechanism can be
> described
> > > in the PQC-ZRTP I-D itself.
> > >
> > > Colin, as the problem of updating ZRTP to a PQ-KEM scheme is mostly
> > > security related it made more sense to me to post it on Saag. The
> perfect
> > > list to discuss it would be the potential "PQC Agility" WG if it is
> charted
> > > at some point (
> > >
> https://mailarchive.ietf.org/arch/msg/saag/5uV72m80X9PTGFWFyDY5VrNyK-c/).
> > > Is there any update on this?
> > >
> > Well, discuss it, perhaps, but given that ZRTP is not an IETF protocol,
> we
> > generally would not publish this document out of that group.
>
> Sorry for splitting hairs, but RFC 6189 does have the "represents the
> consensus of the IETF community" boilerplate, that would seem to  make it
> an IETF protocol by at least some definitions.
>
>
>
> Without taking a position on whether this was hair splitting, ZRTP was not
>
> developed by an IETF WG. It was externally developed and then published
>
> as Informational.
>
>
>
> -Ekr
> IMPORTANT NOTICE: The contents of this email and any attachments are
> confidential and may also be privileged. If you are not the intended
> recipient, please notify the sender immediately and do not disclose the
> contents to any other person, use it for any purpose, or store or copy the
> information in any medium. Thank you.
>