Re: [lamps] draft-housley-lamps-cms-aes-mac-alg-00 Section 7

["Brockhaus, Hendrik" <[e-mail]>]

The goal was to make the consequences more explicit.
Hendrik

> Von: Russ Housley <[e-mail]>
> Gesendet: Montag, 23. November 2020 19:02
> 
> Section 3.1 says: Within the scope of any content-authentication key, the
> nonce value MUST be unique.
> 
> I agree that the Security Considerations should also talk about the
> consequences of reusing a nonce value.
> 
> Russ
> 
> 
> > On Nov 23, 2020, at 12:36 PM, Brockhaus, Hendrik
> <[e-mail]> wrote:
> >
> > Hi Russ
> >
> > As in AES-GMAC the uniqueness of the nonce is crucial,  I want to propose
> to add the following text in Section 7 right before the last paragraph.
> > "Implementations must generate nonce values which must be unique for a
> given message-authentication key. Repeating a nonce value only once allows
> an attacker to generate valid AES-GMAC authentication codes for arbitrary
> messages, which results in no security of the authentication code (see [GCM],
> Appendix A)."
> >
> > May be it is also of value to add this in Section 5 of draft-housley-lamps-
> crmf-update-algs as well.
> >
> > Hendrik
> >
> >
> > Hendrik Brockhaus
> > Siemens AG
> > T RDA CST SEA-DE
> > mailto:[e-mail]
> >
> > http://www.siemens.com/
> >
> > Siemens Aktiengesellschaft: Chairman of the Supervisory Board: Jim
> Hagemann Snabe; Managing Board: Joe Kaeser, Chairman, President and Chief
> Executive Officer; Roland Busch, Klaus Helmrich, Cedrik Neike, Matthias
> Rebellius, Ralf P. Thomas, Judith Wiese; Registered offices: Berlin and Munich,
> Germany; Commercial registries: Berlin-Charlottenburg, HRB 12300, Munich,
> HRB 6684; WEEE-Reg.-No. DE 23691322