Subject: [AVTCORE] Criticism on draft-ietf-avtcore-srtp-aes-gcm

From: Florian Zeitz <[email-masked]>
Date: Tue, 22 Apr 2014 17:11:17 +0200

Hello,

I'd like to call this working group's attention to the fact that
yesterday an article in german language[1] was published, harshly
criticising draft-ietf-avtcore-srtp-aes-gcm-11.

The draft is therein called the NSA's newest attempt at weakening
internet security.
The criticism is largely based on Niels Ferguson's 2005 paper
"Authentication weaknesses in GCM"[2].

In particular the points I can identify are:

Repeated from Ferguson's paper
* GCM should no longer be used
* if GCM has to be used, the authentication tag should be 128-bit
  (the draft currently mandates implementation of the 64-bit
   variant, the others are purely optional)
* the paper uses telephony as an example in it's "A disastrous scenario"
  section. Yet this draft recommends GCM for telephony

Attributed to Michael Kafka, a "security expert" from Vienna:
* mixing confidentiality and authentication makes attacks easier
* in practice performance gains are negligible on modern smartphones

The article also insinuates that David McGrew is deliberately
co-authoring a draft he knows to be insecure, somehow under the pressure
of the NSA.

While I do not necessarily personally agree with the criticism, or the
conclusions, I would like this working group and the authors to address
it in some way.

Regards,
Florian Zeitz

[1] http://fm4.orf.at/stories/1737330/
[2]
http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/comments/CWC-GCM/Ferguson2.pdf

---

From: Magnus Westerlund <[email-masked]>
Date: Thu, 24 Apr 2014 16:51:29 +0200

Florian,

I would like to point out one factual error in your criticism:

The draft does mandate support for the longest 128 bit authentication
tag if one support the cipher at all. This is a quote from Section 13.1:

   Any implementation of AES-GCM SRTP MUST support both AEAD_AES_128_GCM
   and AEAD_AES_256_GCM (the versions with 16 octet AEAD authentication
   tags), and it MAY support the four other variants shown in table 1.

Similarly from 13.2 for AES-CCM

   Any implementation of AES-CCM SRTP/SRTCP MUST support both
   AEAD_AES_128_CCM and AEAD_AES_256_CCM (the versions with 16 octet
   AEAD authentication tags), and MAY support the other four variants.

But, to be fair this was changed very recently.

I would also note that the draft's security consideration section do
discuss the shorter than authentication tag length of actual
authentication protection for AES-GCM.

It is up to the WG to discuss if it thinks there should be any changes
based on your input. And I have to ask you what you think should be the
action based on your personal opinion.

Cheers

Magnus Westerlund
WG chair

On 2014-04-22 17:11, Florian Zeitz wrote:
> _______________________________________________
> Audio/Video Transport Core Maintenance
> [email-masked]
> https://www.ietf.org/mailman/listinfo/avt
> 
> 

-- 

Magnus Westerlund

----------------------------------------------------------------------
Services, Media and Network features, Ericsson Research EAB/TXM
----------------------------------------------------------------------
Ericsson AB                 | Phone  +46 10 7148287
Färögatan 6                 | Mobile +46 73 0949079
SE-164 80 Stockholm, Sweden | mailto: [email-masked]
----------------------------------------------------------------------

---

From: Florian Zeitz <[email-masked]>
Date: Fri, 25 Apr 2014 01:21:01 +0200

> Florian,
Hello Magnus,

> But, to be fair this was changed very recently.
I'm admittedly a bit irritated, by you calling this my criticism.
Particularly after having pointed out I do not fully agree with it, but
am merely the messenger.
The parenthetical you refer to is my own analysis however. And in fact
it does appear I accidentally read the -10 version of the draft. I do
apologize for that mistake.

> action based on your personal opinion.
I suspect you might be wondering why I'm bringing this up if I don't
fully agree with the criticism. The reason is quite simply that I still
believe in the IETF culture. In particular I believe that, unlike what
many media outlets are claiming recently, the IETF and its WGs are fully
capable of appropriately dealing with criticism, and not letting
themselves gag by any government agency. (I.e. in some way I'm trying to
prove a point here)

However, dealing with criticism is only possible, when it is actually
expressed towards the WG, which apparently neither Erich Möchel nor
Michael Kafka found necessary.

I see two ways to address this:
Either the WG agrees with the criticism, the logical consequence of
which would be removing GCM from the draft.
Or the authors/WG explain why they believe this draft to be reasonably
secure, despite the criticism, and proceed with the current wording.

David McGrew choose the second option, and I'm personally content with
that. Hearing a second opinion from other WG members would be
appreciated though.

Regards

Florian Zeitz

---

From: Magnus Westerlund <[email-masked]>
Date: Fri, 25 Apr 2014 08:44:32 +0200

Hi Florian and WG,

Please see inline.

> Particularly after having pointed out I do not fully agree with it, but

Sorry, poorly worded to attribute it to you.

> Michael Kafka found necessary.

Thanks for bringing it to the WG's attention. You are correct, that the
WG needs to be made aware and have the chance to discuss and consider this.

> that. Hearing a second opinion from other WG members would be

I hope the WG participants are happy to review this criticism and
consider McGrew's response as well as what the current version of the
draft says in forming their own opinions, and hopefully state where they
stand. If people have proposals for corrections or clarifications to the
draft they can also be brought forward.

>From a process point of view, as this document is currently in a
publication has been requested state we can continue the WG discussion
while the AD performs her review. The WG will have to form some
concluding position at the end of the IETF review if not before.

I would hope that people can provide their input into this over the next
two weeks, i.e. by the 9th of May.

Regards

Magnus Westerlund
As WG chair