Re: [secdir] SecDir review of draft-ietf-mpls-ldp-hello-crypto-auth-05

["Bhatia, Manav (Manav)" <[e-mail]>]

Hi Yaron,

> >
> > Can you suggest what else needs to be added to make it clearer?
> 
> I suggest to add: "Any unspecified values are encoded as zero."

Sure, will do.

> >
> >>
> [...]
> >>
> >>>> * 7: 128-bit keys are OK (or overkill) for some algorithms, but
> too
> >>>> short for others. In general, the recommended key length is not
> >>>> constant. It depends on the algorithm.
> >>>
> >>> This needs to be punched on each router console. For an internal
> >> network, do you think 128 bit isnt good enough?
> >>
> >> Personally, I think 128 bits are great :-) Seriously, if people are
> >> using HMAC-SHA-512 then 128 is not appropriate. You can argue that
> you
> >> don't need more than 128 bits of entropy, but then I would suggest
> to
> >> remove SHA-512 from the draft. The general point is that different
> >> algorithms require different key lengths.
> >
> > I think you missed the text in Sec 5.1 which says:
> >
> >     The LDP Cryptographic Protocol ID is appended to the
> Authentication
> >     Key (K) yielding a Protocol Specific Authentication Key (Ks).  In
> >     this application, Ko is always L octets long.  While [RFC2104]
> >     supports a key that is up to B octets long, this application uses
> L
> >     as the Ks length consistent with [RFC4822], [RFC5310], [RFC5709]
> and
> >     [RFC7166].
> >
> > In case of HMAC-SHA-512 the key size would be 512 bits.
> >
> > We never restrict the key size to 128.
> >
> 
> I was referring to the following text, which I still think is
> misguided:
> "Deployments SHOULD use sufficiently long and random values for the
> Authentication Key so that guessing and other cryptographic attacks on
> the key are not feasible in their environments.  Furthermore, it is
> RECOMMENDED that Authentication Keys incorporate at least 128
> pseudo-random bits to minimize the risk of such attacks."
> 
> Crypto keys should have random bits amounting to their full length,
> rather than just a 128-bit subset of the key.

Thanks for the catch. I agree, it doesn't make sense to use a subset of the key. Will remove this.

Cheers, Manav

> 
> >>
> >>>>
> [...]
> 
> >
> > Cheers, Manav
> >