[tcpm] Guidance on selection of MAC algorithms for TCP-AO

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

The following is posted on behalf of Tim Polk since it did not appear on
the list as intended (he may not be a subscriber).

Please CC this message in replies to include Tim, Russ, and Pasi on any
discussion.

Joe

- ----

From: Tim Polk <tim.polk@nist.gov>
Date: Tue, 18 Nov 2008 17:13:07 -0000
To: <tcpm@ietf.org>
Cc: Russ Housley <housley@vigilsec.com>, Pasi Eronen
<Pasi.Eronen@nokia.com>,
Lars Eggert <lars.eggert@nokia.com>
Subject: Guidance on selection of MAC algorithms for TCP-AO

TCP-AO needs to make two decisions with respect to MAC algorithms:
select algorithms for the current specification; and establish
criteria for specification of MAC algorithms in the future.  To be
honest, there are numerous MAC algorithms that could satisfy TCP-AO's
security requirements.  Pragmatic issues like performance and current
code bases need to be factored in as well.

The two most attractive options for generating the MAC are AES 128 in
the cipher-based message authentication code (CMAC) mode and the
SHA-1 Hash-based Message Authentication Code (HMAC).   Both options
provide a high level of security and efficiency.  The AES 128 CMAC is
potentially more efficient, particularly in hardware, but SHA-1 HMAC
is more widely used in Internet protocols and in most cases could be
supported with little or no additional code.

Another aspect of the algorithm selection is whether the tags should
be truncated.  CMAC-AES-128 produces a 128 bit MAC, and HMAC SHA-1
produces a 160 bit result.  The MAC can be truncated to 96 bits
provide a reasonable tradeoff between security and message size.  So,
the algorithms that were in draft-bonica are entirely reasonable
choices: AES-128-CMAC-96 and HMAC-SHA-1-96.  For interoperability,
the working group needs to either specify one MAC algorithm as a MUST
and the other as a SHOULD, or specify MUST implement for both
algorithms.

Note that the security issues driving the migration from SHA-1 to
SHA-256 for digital signatures do not apply here.  The security
strength of SHA-1 HMACs should be sufficient for the foreseeable
future.  In addition, when the tags are truncated to 96 bits it is
debatable if there is any increase in the security.

Since this document provides cryptographic agility, it is also
important to establish requirements for future MAC algorithms.  The
TCPM WG should restrict any future MAC algorithms for this
specification to ones that can protect at least 2**48 messages with a
probability that a collision will occur of less than one in a billion.

Tim Polk, Pasi Eronen, and Russ Housley
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkkjHBMACgkQE5f5cImnZrs7AwCgs6e//srfWiAaBGdwLUXFG5S3
ri8AoJkDthfhZwMngLNdScOLfcN8hPne
=ItkS
-----END PGP SIGNATURE-----
_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www.ietf.org/mailman/listinfo/tcpm