Re: [secdir] draft-ietf-avtcore-aria-srtp-06

[Uri Blumenthal <[e-mail]>]

My assumption would be that the main use case for SRTP is streaming video. For streaming video the main threat is theft of service - aka unauthorized reception. The sender usually doesn't care if some packets don't make it through, which includes being accidentally or maliciously corrupted.

Compounded by the performance requirements (and if my assumption is correct), I can understand why the idea of adding a full authentication tag for every packet is repulsive to SRTP crowd. 

I agree that for SRTP in the above context full-length authentication tags would be highly undesirable, and short tags are all that's needed.

Having said that, I share Ben's concern wrt. "vanity ciphers", and think that it is a bad idea, to be avoided if possible - and fully justified if not. 

TNX!

________________________________________
From: secdir [[e-mail]] on behalf of Ben Laurie [[e-mail]]
Sent: Monday, September 15, 2014 14:12
To: The IESG; [e-mail]; [e-mail]
Subject: [secdir] draft-ietf-avtcore-aria-srtp-06

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the
security area directors.  Document editors and WG chairs should treat
these comments just like any other last call comments.

Summary: ready with issues, or maybe not ready (AD's choice!)

Firstly, I'm not generally keen on RFCs for "vanity" ciphers - or,
indeed, any cipher that's been as lightly reviewed as ARIA has. The
Security ADs may feel differently, so I defer to them.

Secondly, ARIA-CTR and ARIA-GCM both use SHA-1 as a hash function, and
I believe we are trying to deprecate that practice.

Thirdly, I am not familiar enough with SRTP to understand why short
authentication tags are needed, but in general its a bad idea, so I
feel the Security Considerations should explain more fully than
"Ciphersuites with short tag length may be
   considered for specific application environments stated in 7.5 of
   [RFC3711], but the risk of weak authentication described in
   Section 9.5.1 of [RFC3711] should be taken into account."

How would I take this risk into account?

Finally, given that short tags are a risk, why are there no modes with
full-length tags?

_______________________________________________
secdir mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/secdir
wiki: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview