Subject: [perpass] relevant LISP discussion

From: Stephen Farrell <[email-masked]>
Date: Wed, 21 Aug 2013 17:04:53 +0100

Hi,

FYI, there's a thread on the LISP wg list [1] that also seems
relevant here.

S.

[1] http://www.ietf.org/mail-archive/web/lisp/current/msg04659.html

---

From: Stephen Kent <[email-masked]>
Date: Wed, 21 Aug 2013 13:01:17 -0400

I might be more impressed if the sender of the message understood that 
one does not use
EC(DH) to encrypt/decrypt anything!
> _______________________________________________
> perpass mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/perpass
>

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 21 Aug 2013 18:25:47 +0100

On 21 Aug 2013, at 18:01, Stephen Kent <[email-masked]> wrote:

> I might be more impressed if the sender of the message understood that one does not use

Well, help with fixing stuff like that's the kind of help we can get for people. More interesting (for me) would be if lisp could be a useful basis for hiding some higher layer information. I'm not sure if it works or not but sounds worth a look. (And btns might also be worth another look too of course)

S

---

From: Nick Thomas <[email-masked]>
Date: Wed, 21 Aug 2013 19:02:28 +0100

Hi Stephen,

> EC(DH) to encrypt/decrypt anything!

Thanks for the input. I am cryptographically naive, yes. The intention
here isn't to impress anyone; but to hammer out something that might
actually work in the real world.

So the contention is that sha256( ecdh( public, private ) ) is not an
appropriate to use as the secret key for a symmetric block cipher like
aes256... in general? Only for long-lived keys? What happens if peers
change those keys daily, or every T/G/MB?

Or should I just forget about that, and use the ecdh shared secret to
encrypt a separate private key... for each packet? On a certain timescale?

When I first came up with the idea, a L/ISP control plane wasn't part of
it, so I tried to avoid anything with even a whiff of session establishment.

/Nick

---

From: Nick Thomas <[email-masked]>
Date: Wed, 21 Aug 2013 19:31:16 +0100

On 21/08/13 19:02, Nick Thomas wrote:

> Or should I just forget about that, and use the ecdh shared secret
> to encrypt a separate private key... for each packet? On a certain
> timescale?

to encrypt a separate shared secret*, I should say.

/Nick

---

From: Stephen Kent <[email-masked]>
Date: Wed, 21 Aug 2013 15:22:48 -0400

Nick,

> change those keys daily, or every T/G/MB?
My comment is that DH (EC or otheriwse) is a key agreement alg, and thus
does not encrypt/decrypt anything. It generates a shared, secret bit 
string that
can be processed to yield a key for a symmetric encryption or integrity 
alg.
A function used to generate such keys is called a KDF (key derivation 
function).
A symmetric alg with with such a key is used might or might not be a block
cipher. If one wants to generate a different (symmetric) encryption key
frequently, changing a DH key bound to an entity via a repository is not
a viable approach. Instead, one uses a random value as an additional 
input to the
KDF (a value sometimes referred to as a UKM, e.g., in the CMS spec).

Steve