[Teep] Scalability of nonce-based freshness

[Göran Selander <[e-mail]>]

Hi Dave, and all,

Referring to the TEEP protocol presentation at the WG meeting, there was a discussion about the use of tokens and what method of freshness to apply in TEEP (slides 11-16 in the presentation).

If I understood right the main argument against the nonce-based method (slide 15) is the question of scalability: "Receivers have to keep state to remember each nonce supplied until it’s used" 

If I'm not mistaken, this condition on the receiver could be relaxed by the receiver generating nonces as encrypted time stamps. This would only require the receiver to remember an encryption context used to encrypt/decrypt the time stamps used as nonces. The encryption context can be small (say, less than 50 bytes for key, IV and counter) and doesn't grow with the number of TAs (but would typically be updated for each nonce generated, e.g. stepping the counter).

Note that the receiver needs a clock but it need not be synced because the time stamps are only used by receiver; once when nonces are generated, and then again when freshness is determined from the nonce received back in the evidence. Such a clock coincides with the assumption of this method according to slide 15: "Receivers need a clock to “expire” nonces, but need not be synced".

Perhaps this should be an input to RATS rather than TEEP. But since this seemed to be the main argument against the nonce-based method I just wanted to share my 2 cents to the discussion. 


Göran