Subject: [Emu] Duplicate integrity protection on Protected Payload data in GPSK

From: Lakshminath Dondeti <[email-masked]>
Date: Sun, 16 Jul 2006 16:35:52 -0700

My reading of the GPSK draft is that the Protected Payload data will 
be integrity protected using the MAC from the combined mode and there 
is the integrity checksum over the entire GPSK-Message.  I think we 
should avoid the multiple MACs.

Thoughts?

regards,
Lakshminath

_______________________________________________
Emu mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/emu

---

From: Charles Clancy <[email-masked]>
Date: Sun, 16 Jul 2006 20:51:47 -0400

> should avoid the multiple MACs.

...

 > I am curious about others' opinions on EAX vs. CCM.

We could replace AES-EAX with AES-CBC.  Would address both your concerns?

-- 
t. charles clancy, ph.d.  |  [email-masked]  |  www.cs.umd.edu/~clancy

---

From: Lakshminath Dondeti <[email-masked]>
Date: Sun, 16 Jul 2006 23:42:19 -0700

>We could replace AES-EAX with AES-CBC.  Would address both your concerns?

That's one way, sure!  Given that the encryption might be over only 
one of the payloads of the GPSK messages and since these are key 
management messages anyway (just 4 messages, at initial 
authentication), we don't need the processing efficiencies of CTR 
mode that comes with EAX or CCM.  So AES-CBC is just fine.

If we do want to use EAX or CCM, a possibility is to "apply" EAX or 
CCM over the entire message with most of the message as the AAD and 
have the encryption spanning either the Protected Payload data or 
NULL.  (My recollection is that Joe and I discussed this in Montreal 
as a possibility; not sure whether we agreed on it though!)

regards,
Lakshminath

---

From: Hannes Tschofenig <[email-masked]>
Date: Mon, 17 Jul 2006 12:16:46 +0200

Hi Lakshminath,

this would make the design more difficult.

There is almost no performance penality of having two MACs.

Ciao
Hannes

Lakshminath Dondeti wrote:
> My reading of the GPSK draft is that the Protected Payload data will be 
> integrity protected using the MAC from the combined mode and there is 
> the integrity checksum over the entire GPSK-Message.  I think we should 
> avoid the multiple MACs.
> 
> Thoughts?
> 
> regards,
> Lakshminath
> 
>

---

From: Lakshminath Dondeti <[email-masked]>
Date: Mon, 17 Jul 2006 20:41:29 -0700

>There is almost no performance penality of having two MACs.

I disagree in this case.  Unless there is a strong need to have 
separate MAC protection for the Protected data payload, I think the 
second MAC is spurious and comes only as a side effect of the use of 
a combined mode algorithm.  Surely that's not a justification for 
adding 96 or so bits to the GPSK messages.

Lakshminath

>>My reading of the GPSK draft is that the Protected Payload data 
>>will be integrity protected using the MAC from the combined mode 
>>and there is the integrity checksum over the entire 
>>GPSK-Message.  I think we should avoid the multiple MACs.
>>Thoughts?
>>regards,
>>Lakshminath
>>