Subject: [secdir] review of draft-ietf-avt-srtp-big-aes-05.txt

From: "Hilarie Orman" <[email-masked]>
Date: Tue, 4 Jan 2011 15:26:40 -0700

Security review of draft-ietf-avt-srtp-big-aes-05.txt

Do not be alarmed.  I have reviewed this document as part of the
security directorate's ongoing effort to review all IETF documents
being processed by the IESG. These comments were written primarily for
the benefit of the security area directors. Document editors and WG
chairs should treat these comments just like any other last call
comments.

This is a very well-written document about using AES-192 and AES-256
with RTP, and I have only a few comments.

There is no comment on why AES-192 might be used.  There is a comment
about AES-128 vs. AES-256, but AES-192 seems to fall into a useless
middle ground.  I'd like to see some comment about it.

Section 3.1 "Usage Requirements" might be easier to understand if it
said that "When AES_192_CM is used for encryption, the key derivation
function MUST have a cryptographic strength of at least 192 bits;
AES_192_CM has this strength, AES_128_CM does not."  Similarly for
AES_256_CM.

It would be helpful to note which data items are specific to SRTP.
The draft says that it uses the terminology of "Section 4.1.1 of
[RFC3711]", but oddly enough, the "SSRC" is not defined in that
document, either.  One must go back to RFC3550 for its definition.

I was flummoxed by the math of "if kdr=0 then (index DIV kdr) = 0".
RFC3711 section 4.3.1 does explain it; it's kind of confusing to have to
switch back and forth between the two documents.

The block counter "b_c" is two octets, but the "default key lifetime"
is 2^31.  Is this perhaps the "maximum" key lifetime?  Should
implementors introduce an internal counter to keep track of the
history of key usage (across sessions?)?  Perhaps earlier documents
explain this?

Hilarie

---

From: David McGrew <[email-masked]>
Date: Wed, 5 Jan 2011 14:55:42 -0800

Hi Hilarie,

thanks for your detailed review.

> middle ground.  I'd like to see some comment about it.

I agree that AES-192 doesn't seem that useful.  When the draft was  
first presented to AVT WG, the sentiment of the room was that AES-192  
might be useful, so the draft should include it, so that people have  
the option of using it if it seems valuable in the future.  I suppose  
the draft ought to say something like that.  How about:

AES-256 provides the highest level of security, and it SHOULD be used  
whenever the highest possible security is desired.  AES-192 provides a  
middle ground between the 128-bit and 256-bit versions of AES, and it  
MAY be used when higher security than AES-128 is desired.

> AES_192_CM has this strength, AES_128_CM does not."  Similarly for

Sounds good.

> document, either.  One must go back to RFC3550 for its definition.

That's a very constructive suggestion.

> history of key usage (across sessions?)?  Perhaps earlier documents

The key lifetime is the maximum number of packets that can be  
protected using a single key.  The packets are no longer than 2^18  
bytes, so limiting the number of packets is a convenient way to limit  
the number of bytes.

Perhaps the draft should mention that this parameter (and the other  
cryptosuite parameters) are defined in Section 8.2 of RFC 3711.

thanks again,

David

> Hilarie
>
>
>
>
> _______________________________________________
> secdir mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/secdir