Re: [lamps] draft-housley-lamps-cms-aes-mac-alg-00 Section 7

[Russ Housley <[e-mail]>]

Section 3.1 says: Within the scope of any content-authentication key, the nonce value MUST be unique.

I agree that the Security Considerations should also talk about the consequences of reusing a nonce value.

Russ


> On Nov 23, 2020, at 12:36 PM, Brockhaus, Hendrik <[e-mail]> wrote:
> 
> Hi Russ
> 
> As in AES-GMAC the uniqueness of the nonce is crucial,  I want to propose to add the following text in Section 7 right before the last paragraph.
> "Implementations must generate nonce values which must be unique for a given message-authentication key. Repeating a nonce value only once allows an attacker to generate valid AES-GMAC authentication codes for arbitrary messages, which results in no security of the authentication code (see [GCM], Appendix A)."
> 
> May be it is also of value to add this in Section 5 of draft-housley-lamps-crmf-update-algs as well.
> 
> Hendrik
> 
> 
> Hendrik Brockhaus
> Siemens AG
> T RDA CST SEA-DE
> mailto:[e-mail]
> 
> www.siemens.com
> 
> Siemens Aktiengesellschaft: Chairman of the Supervisory Board: Jim Hagemann Snabe; Managing Board: Joe Kaeser, Chairman, President and Chief Executive Officer; Roland Busch, Klaus Helmrich, Cedrik Neike, Matthias Rebellius, Ralf P. Thomas, Judith Wiese; Registered offices: Berlin and Munich, Germany; Commercial registries: Berlin-Charlottenburg, HRB 12300, Munich, HRB 6684; WEEE-Reg.-No. DE 23691322