Re: [secdir] SecDir review of draft-ietf-mpls-ldp-hello-crypto-auth-05

[Yaron Sheffer <[e-mail]>]

On 05/16/2014 05:43 PM, Uri Blumenthal wrote:
> Quoting Yaron Sheffer <[e-mail]>:
>> .......
>> This document proposes to add cryptographic authentication to LDP "all
>> routers" Hello messages, which are transported as unicast UDP.
>>
>> • 5.1: Redefining HMAC (RFC 2104) is an extremely bad idea. This
>> reviewer does not have the appropriate background to critique the
>> proposed solution, but there must be an overwhelming reason to reopen
>> cryptographic primitives.
>
> They do seem to be using HMAC, even though without explicitly naming it
> so (5.1
> and 5.2). Also, HMAC is referred to in the Normative References.
>

Yes, of course. But then they argue with the standard definition, "While 
[RFC2104] supports a key that is up to B octets long, this application 
uses L as the Ks length consistent with [...]". And then instead of 
using it like a black box, they spell it out in 5.2, so developers are 
encouraged to re-implement HMAC instead of using one of dozens of 
existing implementations.

>> • "The mechanism described herein is not perfect and does not need to be
>> perfect." This is kind of vague, and would be better replaced by your
>> security goals.
>
> Concur. :-)
>