Re: [saag] [Cfrg] Re: TCP-AO MAC algorithms

[Sean Shuo Shen <[e-mail]>]

>> First, I remember somewhere it is said that the MAC key should be renewed
>> when sequence number rollover, in your first email you also mentioned
that
>> "This is why we probably need to explicitly require that the connection
key
>> change whenever the sequence number rolls over (through the ISN)." I
believe
>> you are giving a reasonable and achievable requirement (hash key renewing
>> during rollover). If hash key renewing during rollover is doable, nonce
key
>> renewing during rollover is also doable and it's not an extra
requirement.
>> The way to renew keys is out of the scope of our discussion. I don't
think
>> we have to give a key management scheme before talking about MAC
algorithms.
>It all depends on whether key reuse during rollover is prohibited 
>outright or just recommended against. If the former, I agree it's 
>sufficient to roll over the nonce key at the same time. It's the latter 
>case that's the issue, and whether to make this something FIPS 
>certification relies upon.
Key reuse during rollover is prohibited.

>> Second, maybe there is a misunderstanding here. What I mean is: the nonce
>> generation algorithm can guarantee that nonce is different when the MAC
>> protected data are different (because some mac algorithms require
different
>> nonce when hashing different messages). If the MAC protected data (I
assume
>> this is what you mean by "socket data") are same between transmission and
>> retransmission, it is totally fine for nonce to be same.
>That depends on whether the nonce is used to provide replay protection.
>If it is, then it can't be the same if the entire segment is the same.
The nonce here is not used against replay attack. 

Sean