Re: [tcpm] tcp-auth-opt issue: keyID randomness
Ron Bonica <rbonica@juniper.net> Mon, 04 August 2008 17:41 UTC
Return-Path: <tcpm-bounces@ietf.org>
X-Original-To: tcpm-archive@megatron.ietf.org
Delivered-To: ietfarch-tcpm-archive@core3.amsl.com
Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 649713A6D1A; Mon, 4 Aug 2008 10:41:29 -0700 (PDT)
X-Original-To: tcpm@core3.amsl.com
Delivered-To: tcpm@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DDE373A6D1A for <tcpm@core3.amsl.com>; Mon, 4 Aug 2008 10:41:27 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.468
X-Spam-Level:
X-Spam-Status: No, score=-6.468 tagged_above=-999 required=5 tests=[AWL=0.131, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ELRPmYhWmW2Y for <tcpm@core3.amsl.com>; Mon, 4 Aug 2008 10:41:27 -0700 (PDT)
Received: from exprod7og114.obsmtp.com (exprod7ob114.obsmtp.com [64.18.2.214]) by core3.amsl.com (Postfix) with ESMTP id F01333A6914 for <tcpm@ietf.org>; Mon, 4 Aug 2008 10:41:24 -0700 (PDT)
Received: from source ([66.129.228.6]) by exprod7ob114.postini.com ([64.18.6.12]) with SMTP; Mon, 04 Aug 2008 10:41:53 PDT
Received: from p-emlb01-sac.jnpr.net ([66.129.254.46]) by p-emsmtp01.jnpr.net with Microsoft SMTPSVC(6.0.3790.3959); Mon, 4 Aug 2008 10:41:51 -0700
Received: from pi-smtp.jnpr.net ([10.10.2.36]) by p-emlb01-sac.jnpr.net with Microsoft SMTPSVC(6.0.3790.3959); Mon, 4 Aug 2008 10:41:51 -0700
Received: from proton.jnpr.net ([10.10.2.37]) by pi-smtp.jnpr.net with Microsoft SMTPSVC(5.0.2195.6713); Mon, 4 Aug 2008 13:41:50 -0400
Received: from [172.28.13.57] ([172.28.13.57] RDNS failed) by proton.jnpr.net with Microsoft SMTPSVC(6.0.3790.1830); Mon, 4 Aug 2008 13:41:50 -0400
Message-ID: <48973F5B.8030108@juniper.net>
Date: Mon, 04 Aug 2008 13:41:47 -0400
From: Ron Bonica <rbonica@juniper.net>
User-Agent: Thunderbird 2.0.0.16 (Windows/20080708)
MIME-Version: 1.0
To: Joe Touch <touch@ISI.EDU>
References: <4890F270.8000902@isi.edu>
In-Reply-To: <4890F270.8000902@isi.edu>
X-Enigmail-Version: 0.95.6
X-OriginalArrivalTime: 04 Aug 2008 17:41:50.0435 (UTC) FILETIME=[6011A330:01C8F659]
Cc: tcpm@ietf.org
Subject: Re: [tcpm] tcp-auth-opt issue: keyID randomness
X-BeenThere: tcpm@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: TCP Maintenance and Minor Extensions Working Group <tcpm.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/tcpm>, <mailto:tcpm-request@ietf.org?subject=unsubscribe>
List-Archive: <https://www.ietf.org/mailman/private/tcpm>
List-Post: <mailto:tcpm@ietf.org>
List-Help: <mailto:tcpm-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tcpm>, <mailto:tcpm-request@ietf.org?subject=subscribe>
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="us-ascii"; Format="flowed"
Sender: tcpm-bounces@ietf.org
Errors-To: tcpm-bounces@ietf.org
Joe,
I don't think that the TSPI/keyID should be selected at random. The
range of values is so small that guessing the value is trivial.
Ron
Joe Touch wrote:
> As per Ran's request, should the keyID be selected at random to enable
> early discard algorithms, e.g., to reduce the impact of an attacker who
> would need to guess a valid keyID value?
>
> I discussed this issue with Ran, and suggested that all crypto
> properties should be contained in the MAC field; such a field
> might include a 'hard to guess' arbitrary fixed part and a
> computed (e.g., HMAC) part, to enable efficient 'triage'
> of randomly-generated DOS packets.
>
> Overall, this suggests that the document could note that the keyID is
> NOT intended for protection, and any valid values may be used at any time.
>
> Comments (esp. from Ran, who raised the issue)?
>
>
>
_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www.ietf.org/mailman/listinfo/tcpm
_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www.ietf.org/mailman/listinfo/tcpm