Subject: [lamps] AD Review: draft-ietf-lamps-cms-aes-gmac-alg-02

From: Roman Danyliw <[email-masked]>
Date: Tue, 26 Jan 2021 02:10:25 +0000

Hi!

I conducted an AD review draft-ietf-lamps-cms-aes-gmac-alg-02.  Thanks for the work to bring AES-GMAC to CMS.  Here is my feedback:

** Questions about the recommendation in Section 3.1 for a 12 octet tag has come up a few times [1][2][3].  Thanks for adding the text in -02 to explain the origin as being from RFC5084 per [1]. If we decide to go that way, [2] makes a good suggestion to also add it to the comments.  [3] acknowledges the alignment with RFC5084 but speculates whether 13-year old guidance since applies. Like [3] I couldn't find any relevant NIST or RFCs to meaningfully cite.  In addition to RFC5282, there is also RFC4543 which also recommend 16-bytes for the nonce.  However, I'm sensitive to those requirements potentially being protocol specific and CMS has a wider set of applications.  As an aside, this variability in application should be explicitly stated.  

Is the thinking with [4] to make support for 12 and 16 octets a MUST, with the 12 there for parity with RFC5084 and the 16 because we think that's the right balance in 2021?

[1] https://mailarchive.ietf.org/arch/msg/spasm/KrmkF6kkbg8-pU4MpjgpTVmxzik/
[2] https://mailarchive.ietf.org/arch/msg/spasm/T9UhA9T9j85o6VYjT-9D2JnTEic/
[3] https://mailarchive.ietf.org/arch/msg/spasm/7qqXzNFuA1YDFnfHw8oL9OVK_Dc/
[4] https://mailarchive.ietf.org/arch/msg/spasm/g1-09MkwebIO3kI0T2sY5nBF2JM/

** Section 3.1.  Editorial. Clarifying text adding the specific CMS field name that carries the algorithm identifier.

OLD
   The AES-GMAC [AES][GCM] Message Authentication Code (MAC) algorithm
   uses one of the following algorithm identifiers; 
NEW
   The AES-GMAC [AES][GCM] Message Authentication Code (MAC) algorithm
   uses one of the following algorithm identifiers in the AuthenticatedData macAlgorithm field;

** Section 3.1.  Per "The nonce may have any number of bits between 8 and 2^64 ...", should this read 2^64 - 1?  Page 8 of [GCM]  (https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf) says "The bit lengths of the input strings to the authenticated encryption function shall meet the following requirements: ... 1 <= len(IV) <= 2^64-1"

** Section 3.1.  Typo.  s/field field/field/

Regards,
Roman

---

From: Russ Housley <[email-masked]>
Date: Tue, 26 Jan 2021 18:48:55 -0500

Roman:

On 23 Dec 2020, Quynh Dang from NIST said: "12 octets are fine for many use cases. "  Given this, keeping some compatibility with RFC 5084 seems wise.

I will make the other three changes.

Russ

> On Jan 25, 2021, at 9:10 PM, Roman Danyliw <[email-masked]> wrote:
> 
> Hi!
> 
> _______________________________________________
> Spasm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/spasm