Subject: [kitten] I-D Action: draft-ietf-kitten-aes-cts-hmac-sha2-05.txt

From: [email-masked]
Date: Tue, 23 Sep 2014 05:25:46 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Common Authentication Technology Next Generation Working Group of the IETF.

        Title           : AES Encryption with HMAC-SHA2 for Kerberos 5
        Authors         : Michael J. Jenkins
                          Michael A. Peck
                          Kelley W. Burgin
	Filename        : draft-ietf-kitten-aes-cts-hmac-sha2-05.txt
	Pages           : 16
	Date            : 2014-09-23

Abstract:
   This document specifies two encryption types and two corresponding
   checksum types for Kerberos 5.  The new types use AES in CTS mode
   (CBC mode with ciphertext stealing) for confidentiality and HMAC with
   a SHA-2 hash for integrity.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-kitten-aes-cts-hmac-sha2/

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-kitten-aes-cts-hmac-sha2-05

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-kitten-aes-cts-hmac-sha2-05

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Simo Sorce <[email-masked]>
Date: Tue, 30 Sep 2014 14:10:40 -0400

On Tue, 23 Sep 2014 05:25:46 -0700
[email-masked] wrote:

> 
> A New Internet-Draft is available from the on-line Internet-Drafts
> directories. This draft is a work item of the Common Authentication
> Technology Next Generation Working Group of the IETF.
> 

Hi while reading this otherwise very nice specification two questions
kept popping in my mind.

Why SHA-512 is not being used ?
Why AES-192 is not being used and SHA-384 is paired with AES-256
instead ?
Why are you using a hash twice the size of the bit strength required,
and chop it off, isn't HMAC supposedly not affected by birthday
attacks ?

I can guess at the rationale of some of these choices (some of it was
discussed in IETF meetings/lists), but it would be nice to have a
section that explains the choice or even just a reference to some other
document that does.

Regards,
Simo.

-- 
Simo Sorce * Red Hat, Inc * New York