Re: [saag] PQC in ZRTP (RFC6189) and hybrid KEM

[Johan Pascal <[e-mail]>]

Thanks all for your replies,

Ekr, I think ZRTP is still relevant despite progress in voice synthesis. Yes it is easy to generate a SAS code impersonating someone voice but then you have to insert it with the right timing in a live conversation.

This publication https://nsaxena.engr.tamu.edu/wp-content/uploads/sites/238/2019/12/ss-ccs14-1.pdf" rel="nofollow">https://nsaxena.engr.tamu.edu/wp-content/uploads/sites/238/2019/12/ss-ccs14-1.pdf is I think the one addressing the more directly the subject and indeed prove that speech synthesis can easily fool real people in the context of SAS comparison. However I don't think they fully cover the SAS insertion without introducing painful delay in a live call.

Jon, Colin, I just posted both on this list and on avtcore a small synthesis of how I plan to modify ZRTP to use KEM instead of (EC)DH. I have two slightly different solutions, any comments will be more than welcome.

Regards,

Johan

On 23/11/2021 17:20, Eric Rescorla wrote:

On Tue, Nov 23, 2021 at 4:55 AM Hannes Tschofenig <[e-mail]> wrote:

Ben,

 

this shows that even IETF experts have a hard time differentiating IETF consensus documents from those who aren’t.

I wonder how often people believed that ZRTP was the product of an IETF working group.

 

A few years have passed since the publication of ZRTP and attacker capabilities have changed. I am wondering whether the security model of ZRTP is still meaningful today.

I think at this point we have fairly strong evidence that of in-band confirmation of SAS codes is fairly subject to impersonation via modern voice synthesis techniques.

See: https://www.rfc-editor.org/rfc/rfc8826.html#section-4.3.2.2" class="moz-txt-link-freetext" rel="nofollow">https://www.rfc-editor.org/rfc/rfc8826.html#section-4.3.2.2

-Ekr

 

Ciao

Hannes

 

 

From: saag <[e-mail]> On Behalf Of Eric Rescorla
Sent: Tuesday, November 23, 2021 1:16 PM
To: Benjamin Kaduk <[e-mail]>
Cc: IETF SAAG <[e-mail]>
Subject: Re: [saag] PQC in ZRTP (RFC6189) and hybrid KEM

 

 

 

On Mon, Nov 22, 2021 at 10:27 PM Benjamin Kaduk <[e-mail]> wrote:

On Mon, Nov 22, 2021 at 09:47:46PM -0800, Eric Rescorla wrote:
> On Mon, Nov 22, 2021 at 9:28 AM Johan Pascal <[e-mail]>
> wrote:
>
> > Hi,
> >
> > thanks for your suggestions. I know the work on hybrid design is already
> > done in TLS and others . While looking for some documentation on that
> > specific problem I found several protocols addressing it, each of them with
> > specific details related to the protocol and that is mainly what led me to
> > think that a document dedicated to hybrid scheme might make sense: it would
> > save the next person trying to achieve exactly what I'm trying to do for
> > ZRTP the work of reading the different specifications, parting what is
> > protocol related and what is not. But the hybrid mechanism can be described
> > in the PQC-ZRTP I-D itself.
> >
> > Colin, as the problem of updating ZRTP to a PQ-KEM scheme is mostly
> > security related it made more sense to me to post it on Saag. The perfect
> > list to discuss it would be the potential "PQC Agility" WG if it is charted
> > at some point (
> > https://mailarchive.ietf.org/arch/msg/saag/5uV72m80X9PTGFWFyDY5VrNyK-c/" target="_blank" class="moz-txt-link-freetext" rel="nofollow"> https://mailarchive.ietf.org/arch/msg/saag/5uV72m80X9PTGFWFyDY5VrNyK-c/).
> > Is there any update on this?
> >
> Well, discuss it, perhaps, but given that ZRTP is not an IETF protocol, we
> generally would not publish this document out of that group.

Sorry for splitting hairs, but RFC 6189 does have the "represents the
consensus of the IETF community" boilerplate, that would seem to  make it
an IETF protocol by at least some definitions.

 

Without taking a position on whether this was hair splitting, ZRTP was not

developed by an IETF WG. It was externally developed and then published

as Informational.

 

-Ekr

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

_______________________________________________
saag mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/saag" rel="nofollow">https://www.ietf.org/mailman/listinfo/saag