Re: [secdir] Security review of draft-ietf-avtcore-aria-srtp-09

[Ben Campbell <[e-mail]>]

> On Jul 5, 2017, at 7:10 PM, Woo-Hwan Kim <[e-mail]> wrote:
> 
> Sorry for our late reply and thank you for your comments.
> 
>>> I have reviewed this document as part of the security directorate's ongoing effort to review >>all IETF documents being processed by the IESG.  These comments were written primarily for >>the benefit of the security area directors.  Document editors and WG chairs should treat >>these comments just like any other last call comments.
>>> 
>>> The summary of the review is ready with nits.
>>> 
>>> This is essentially a drop-in replacement of AES for SRTP with ARIA, a cipher I've never >>heard of.
>>> 
>>> Because it is a drop-in replacement, it uses SHA-1. Probably it would be better practice to >>update the hash function to something more modern.
> 
> We agree. But we think that such updates should be based on the revision of the standard RFC (including RFC 3711). So it may be not possible in this stage.

Given that a main point of this draft is to register current usage, I agree. But would it make sense to add a paragraph to the security considerations pointing out the use of SHA1 and mentioning what needs to happen to evolve the specs to support newer hash functions? (or even hash agility).
> 
>>> The I-D also somewhat eccentrically says that no security problems have been found with ARIA >>whilst referencing a paper on a meet-in-the-middle attack on reduced round ARIA. I am not >>sure what to make of this, though clearly it is not a fatal flaw.
> 
> The reason for referencing the paper [TSL] is that the results of the security analysis on ARIA up to the time when first draft was proposed are summarized in the paper. We wanted that the reference paper is accepted as an evidence of the security of ARIA. Considering the problem you pointed out, however, it seems to be failed to clearly express our intension. So we revised the draft by adding the sentence “Previous security analysis results are summarized in [ATY]”. In addition, we replaced the reference [TSL] by the new reference [ATY] because the results of the security analysis on ARIA have been published to date. This new reference also contains a summary of almost all results of security analysis on ARIA up to date.
> 
> Thanks again for your review, and we've posted a revision(-10) that reflects your feedback.
> 
> Sincerely, Woo-Hwan Kim
>