Re: [TLS] WG interest in draft-chudov-cryptopro-cptls-02.txt

Greetings.

They use usual HMAC, and i think it makes sense
to use the standard scheme from TLS for them
(Null or standard stream cipher, ch. 6.2.3.1).

I think we can put it this way:

   Cipher suites TLS_GOST341094_WITH_NULL_GOSTR3411 and
   TLS_GOST34102001_WITH_NULL_GOSTR3411 use the same
   record payload protection scheme, as described in section 6.2.3.1
   of [TLS]:

     MACed_data[seq_num] = seq_num +
                           TLSCompressed.type +
                           TLSCompressed.version +
                           TLSCompressed.length +
                           TLSCompressed.fragment;

    CipherSpec.hash_size = 32
    GenericStreamCipher.MAC = HMAC_GOSTR3411 (MACed_data[seq_num])

   Cipher suites TLS_GOST341094_WITH_GOST28147_OFB_GOST28147
   and TLS_GOST34102001_WITH_GOST28147_OFB_GOST28147 use
   IMIT_GOST28147 as MAC function. IMIT_GOST28147 is basicly
   a form of GOST28147 cipher. To be robust to attacks based on timing and
   EMI analysis, one symmetric key should not  be used for large quantities 
of
   plaintext, so the CryptoPro Key Meshing algorithm from [CPALGS],
   section 2.3.2, is applied to the MAC keys. Each record MAC is computed,
   using the cipher state resulting from processing the previous record, 
which
   is equivalent to computing the MAC from concatenation of all previous
   records:

    CipherSpec.hash_size = 4
    GenericStreamCipher.MAC = IMIT_GOST28147 (MACed_data[0] +

 ... + MACed_data[n])

Good luck and thanks for feedback.

----- Original Message ----- 
From: "Dmitry Belyavsky" <beldmit@cryptocom.ru>
To: "Gregory S. Chudov" <chudov@cryptopro.ru>
Cc: <tls@ietf.org>
Sent: Wednesday, November 30, 2005 11:26 AM
Subject: Re: [TLS] WG interest in draft-chudov-cryptopro-cptls-02.txt

> Greetings!
...
> Thank you, this paragraph provides enough information for me to understand
> your design decision.
>
> But the section 2 of draft-chudov-cryptopro-cptls-02.txt proposes two
> cipher suites with GOSTR3411-based MAC. Is key meshing applied
> for these cipher suites too or do they use usual HMAC? And what is MACed
> data for them?
 ...
> -- 
> SY, Dmitry Belyavsky (ICQ UIN 11116575)

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls