Re: [tcpm] Review of draft-ietf-tcpm-tcp-auth-opt-01

At Mon, 28 Jul 2008 10:47:48 -0700,
Joe Touch wrote:
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Hi, Eric,
> 
> Eric Rescorla wrote:
> ...
> |> OK; we're dancing around terms here. TCP-AO uses a _separate_ document
> |> to specify the out-of-band key mechanism. What that includes can be
> |> discussed in that context - e.g., on SAAG.
> |
> | Well, I think that's a mistake as well.
> 
> That's outside the scope of this document; that was handed to the design
> team as a requirement of this work. Perhaps the ADs should address the
> reasons directly.

Well, to the extent to which this was an instruction from the
AD, I think this should be reconsidered.

> |     The second needs to be tied to the transport protocol. The
> |     first is replaceable. The problem here is that you have
> |     merged them and treated them both as separate. That's problematic.
> 
> Are you saying that we generate per-session keys inside TCP-AO?

Per-connection keys, yes.

> |> | Sure. You have a per-connection key. Every time the sequence number
> |> | rolls, you run the KDF again to generate a fresh per-connection key.
> |> | No KMP required. (This meshes with my previous key diversification
> |> | comments).
> |>
> |> That's burying the key generation protocol inside TCP-AO.
> |
> | Again, key generation != key establishment.
> 
> Agreed, but there is utility in keeping TCP-AO clean from algorithmic
> crypto issues.

Perhaps, but there's also utility in having a single, complete,
spec.

> | The protocol must be constructed so that it is not possible to substitute
> | one packet for another and have it be accepted. This means that (either)
> | the data fed into the authentication function must be distinct or the
> | authentication function must have a distinct key.
> 
> That implies a per-packet nonce, i.e., some fields - either in the
> packet or external - that are unique on a per-packet basis.

Well, perhaps we're just differing in terminology, but I don't call
per-packet data fed into the authentication function a nonce. 
I think of the nonce as a discrete value, not just the data.
But in this case we're just talking about MACing the packet.

I just checked and neither AH nor TLS uses the term nonce here.

-Ekr
_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www.ietf.org/mailman/listinfo/tcpm