Subject: [dtn-security] CBC or counter mode?
From: Stephen Farrell <[email-masked]>
To: [email-masked]
Cc: DTN <[email-masked]>
Date: Wed, 26 Jul 2006 21:12:26 +0100
List-Id: DTN Security Discussion <dtn-security.mailman.dtnrg.org>

In the current bundle security spec [1] we define a confidentiality
ciphersuite (CH-RSA-AES-PAYLOAD-PSH) that uses AES's cipher-block
chaining (CBC) mode of operation.

CBC mode means that all ciphertext bits depend on all previous
ciphertext bits, so you if you loose some bits from the middle
of the bundle payload then you can no longer decrypt the bits
that follow.

There are other modes of operation generally termed "counter mode"
which do allow for decryption even if some bits get lost. Generally
these modes are a little trickier since its easier to misuse them
and do the wrong security thing, but that's a problem we can solve.
Counter mode is also better from the p-o-v of parallel processing
but I don't think that matters as much here as the improved support
for fragmentation.

So, should we change from CBC to counter mode? I think we should
and that we should decide that now, since there are folks writing
code and it'd be better if we get this done before they release
their stuff. (There is an alternative which is to define two
ciphersuites but that makes the security document longer which is
a bad thing.)

Stephen.

[1] 
http://www.ietf.org/internet-drafts/draft-irtf-dtnrg-bundle-security-01.txt