Subject: RE: [AVT] RFC 3711 Key Derivation

From: "Yuval Nissan" <[email-masked]>
Date: Mon, 29 Nov 2004 15:47:52 +0200

Hi,
Is there any recommendation for the key derivation rate in voice Unicast
session?

As understood form the previous mail the issue of key derivation isn't
that simple as to check whether index mod r equal zero (as written in
section 4.3.1). When we take into consideration possibility of
packet-loss and re-ordering we have to check wrap around of index mod r.

Do you agree?

Thanks,
Yuval 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
[email-masked]
Sent: Monday, November 29, 2004 11:37 AM
To: Ofer Idan
Cc: Yuval Nissan; [email-masked]
Subject: Re: [AVT] RFC 3711 Key Derivation

Hi Ofer,

Ofer Idan wrote:

> I have a question regarding RFC 3711 Key derivation rate.
>
> In section 3.3 the decrypt process is described:
>
> Bullet (4) says to determine the session keys using the maser key,
> master salt, key derivation rate.
>
> Bullet (5) says to check for anti reply, verify authentication.
>
> I think that there might be a problem here.
>
> Consider a scenario where Key derivation rate is supported (different
> than zero).
>
> An attacker can send a packet with a higher sequence number that will
> cause the receiver to change his session keys (according to key
> derivation rate).

Yes, they will be changed when processing *this* packet.

>
>  From this moment on, the two sides will be unsynchronized and the
> conversation will end.

This is not entirely true. As soon as a "correct" packet arrives,
the receiver will update his keys back to the correct value again.

>
> Therefore I think that before updating the session keys the receiver
> must first verify the message (and the sequence number) and only if
> verified he should update all the keys.
>

I would put it differently: for each packet received, the receiver
needs to determine whether key update is needed ot not. This holds
also when no attacker is present: re-ordering of packets could
occur anyway.

> Further more;
>
> I think that when supporting key derivation rate, authentication must
be
> applied. (otherwise the receiver is vulnerable to such attack)
>
> 
>
> What do you think ?

Authentication should always be used.

Best,

/Mats

_______________________________________________
Audio/Video Transport Working Group
[email-masked]
https://www1.ietf.org/mailman/listinfo/avt

************************************************************************************************************
This email and any files transmitted with it are confidential material.
They are intended solely for the use of the designated individual or entity to whom they are addressed.
If the reader of this message is not the intended recipient,
you are hereby notified that any dissemination,use,
distribution or copying of this communication is strictly prohibited and may be unlawful.

If you have received this email in error please notify [email-masked] and permanently delete the e-mail and files.

***********************************************************************************************************

_______________________________________________
Audio/Video Transport Working Group
[email-masked]
https://www1.ietf.org/mailman/listinfo/avt

---

From: Mats Näslund <[email-masked]>
Date: Mon, 29 Nov 2004 15:00:47 +0100

Hi Yuval,

I can agree that the text

"The key derivation function [...] is performed whenever
index mod r equals zero."

is perhaps not the best choice of language. However, in the
more normative text that follows,

"key [...] for this packet SHALL then be derived [...] as follows:",

hopefully the use of "key for THIS packet" should make it
clear that there may be a need for a per-packet derivation.

I do not believe there's a general recommendation, the higher the
rate, the less "wear" on the key, but OTOH the more administration
and overhead.

Best,

/Mats

---

From: Mark Baugher <[email-masked]>
Date: Mon, 29 Nov 2004 09:43:39 -0800

> Is there any recommendation for the key derivation rate in voice  

The default is zero.  I would take that as a recommendation.

Mark

> If you have received this email in error please notify  
> [email-masked] and permanently delete the e-mail and files.
>
>