Re: [secdir] review of draft-ietf-avt-srtp-big-aes-05.txt

[David McGrew <[e-mail]>]

Hi Hilarie,

thanks for your detailed review.

On Jan 4, 2011, at 2:26 PM, Hilarie Orman wrote:

> Security review of draft-ietf-avt-srtp-big-aes-05.txt
>
> Do not be alarmed.  I have reviewed this document as part of the
> security directorate's ongoing effort to review all IETF documents
> being processed by the IESG. These comments were written primarily for
> the benefit of the security area directors. Document editors and WG
> chairs should treat these comments just like any other last call
> comments.
>
> This is a very well-written document about using AES-192 and AES-256
> with RTP, and I have only a few comments.
>
> There is no comment on why AES-192 might be used.  There is a comment
> about AES-128 vs. AES-256, but AES-192 seems to fall into a useless
> middle ground.  I'd like to see some comment about it.

I agree that AES-192 doesn't seem that useful.  When the draft was  
first presented to AVT WG, the sentiment of the room was that AES-192  
might be useful, so the draft should include it, so that people have  
the option of using it if it seems valuable in the future.  I suppose  
the draft ought to say something like that.  How about:

AES-256 provides the highest level of security, and it SHOULD be used  
whenever the highest possible security is desired.  AES-192 provides a  
middle ground between the 128-bit and 256-bit versions of AES, and it  
MAY be used when higher security than AES-128 is desired.

>
> Section 3.1 "Usage Requirements" might be easier to understand if it
> said that "When AES_192_CM is used for encryption, the key derivation
> function MUST have a cryptographic strength of at least 192 bits;
> AES_192_CM has this strength, AES_128_CM does not."  Similarly for
> AES_256_CM.
>

Sounds good.

> It would be helpful to note which data items are specific to SRTP.
> The draft says that it uses the terminology of "Section 4.1.1 of
> [RFC3711]", but oddly enough, the "SSRC" is not defined in that
> document, either.  One must go back to RFC3550 for its definition.
>

That's a very constructive suggestion.

> I was flummoxed by the math of "if kdr=0 then (index DIV kdr) = 0".
> RFC3711 section 4.3.1 does explain it; it's kind of confusing to  
> have to
> switch back and forth between the two documents.
>
> The block counter "b_c" is two octets, but the "default key lifetime"
> is 2^31.  Is this perhaps the "maximum" key lifetime?  Should
> implementors introduce an internal counter to keep track of the
> history of key usage (across sessions?)?  Perhaps earlier documents
> explain this?
>

The key lifetime is the maximum number of packets that can be  
protected using a single key.  The packets are no longer than 2^18  
bytes, so limiting the number of packets is a convenient way to limit  
the number of bytes.

Perhaps the draft should mention that this parameter (and the other  
cryptosuite parameters) are defined in Section 8.2 of RFC 3711.

thanks again,

David

> Hilarie
>
>
>
>
> _______________________________________________
> secdir mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/secdir