Subject: Re: [Cfrg] draft-housley-ccm-mode-00.txt

From: Greg Rose <[email-masked]>
Date: Fri, 16 Aug 2002 03:52:53 +1000

Doing the authentication and the encryption with the same key is bad 
practice. You should take the input key, and derive from it two subordinate 
keys, which are independent of each other as far as an outside attacker can 
tell, then use one of them for the counter mode encryption, the other for 
the CBC-MAC.

regards,
Greg.

At 10:55 AM 8/15/2002 -0400, Housley, Russ wrote:
>Dear CFRG:
>
>I would like to draw your attention to this document.  It contains a 
>specification for an authenticated encryption mode.  It was designed fro 
>use with AES, but, of course, it will work with any 128-bit block cipher.
>
>The authors have submitted it to NIST for consideration as a FIPS 
>mode.  You can learn more about CCM and the other proposed modes at the 
>NIST web site ( see http://csrc.nist.gov/encryption/modes/proposedmodes/ ).
>
>IEEE 802.11 has chosen to make CCM the mandatory to implement AES mode for 
>wireless LAN encryption. IEEE 802.15 has also chosen CCM for use with 
>personal area networks.  In my opinion, this success is due to the lack of 
>a patent (or pending patent from the authors) on CCM.  I suspect that most 
>of the members of this list are aware that other candidate authenticated 
>encryption modes are encumbered.
>
>It is my intention to publish draft-housley-ccm-mode-00.txt as an 
>Informational RFC.  This looks like the appropriate group to review the 
>document.
>
>Russ
>
>_______________________________________________
>Cfrg mailing list
>[email-masked]
>https://www1.ietf.org/mailman/listinfo/cfrg
>

Greg Rose                                       INTERNET: [email-masked]
Qualcomm Australia          VOICE:  +61-2-9817 4188   FAX: +61-2-9817 5199
Level 3, 230 Victoria Road,                http://people.qualcomm.com/ggr/
Gladesville NSW 2111    232B EC8F 44C6 C853 D68F  E107 E6BF CD2F 1081 A37C

_______________________________________________
Cfrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/cfrg

---

From: "Housley, Russ" <[email-masked]>
Date: Thu, 15 Aug 2002 15:59:34 -0400

Greg:

I understand the conventional wisdom that you are offering.  However, 
authenticated encryption (using a single key) has been an area of recent 
research.  IAPM, OCB, and CCM are approaches.

Jakob Jonsson from RSA Labs has done a security proof of CCM.  While the 
proceedings are not out yet, his paper was accepted at SAC.  The peer 
reviewer did not find any problems, and I look forward to the broader 
review once the paper is readily available.

Russ

At 03:52 AM 8/16/2002 +1000, Greg Rose wrote:
>practice. You should take the input key, and derive from it two 
>subordinate keys, which are independent of each other as far as an outside 
>attacker can tell, then use one of them for the counter mode encryption, 
>the other for the CBC-MAC.
>
>regards,
>Greg.
>
>>IEEE 802.11 has chosen to make CCM the mandatory to implement AES mode 
>>for wireless LAN encryption. IEEE 802.15 has also chosen CCM for use with 
>>personal area networks.  In my opinion, this success is due to the lack 
>>of a patent (or pending patent from the authors) on CCM.  I suspect that 
>>most of the members of this list are aware that other candidate 
>>authenticated encryption modes are encumbered.
>>

---

From: Greg Rose <[email-masked]>
Date: Fri, 16 Aug 2002 06:28:29 +1000

>research.  IAPM, OCB, and CCM are approaches.

Yes, and look at how much trouble those (XECB, IAPM, OCB) methods go to, to 
derive unknowable inputs to combine with the data for the authentication 
process. CCM, on the other hand, provides lots of potentially known 
plaintext/ciphertext blocks from the counter mode for an attacker to play 
MAC games with.

I remain uncomfortable. But I can't spend time at the moment, so I withdraw 
my beginning objection.

regards,
Greg.

---

From: Uri Blumenthal <[email-masked]>
Date: Fri, 16 Aug 2002 16:15:40 -0400

On Thursday 15 August 2002 15:59, Housley, Russ wrote:
> authenticated encryption (using a single key) has been an area of
> recent research.  IAPM, OCB, and CCM are approaches.

That conventional wisdom was based on the concept of two
independent algorithms (probably of different strength) - and
on the threat that the failure of the weaker algorithm will
compromise whatever was protected by the stronger
one - when they share the same key.

In this case it's a *combined* algorithm - a "one" thing that
happens to do both encryption and MACing. Thus I don't
think the conventional wisdom applies. In fact, for such
a mode I find it *better* to use a single key.

> Jakob Jonsson from RSA Labs has done a security proof of CCM.  While
> the proceedings are not out yet, his paper was accepted at SAC.  The
> peer reviewer did not find any problems, and I look forward to the
> broader review once the paper is readily available.

I'd like a look at that paper, if possible.

Thanks!

> >subordinate keys, which are independent of each other as far as an
> > outside attacker can tell, then use one of them for the counter
> > mode encryption, the other for the CBC-MAC.
> >
> >regards,
> >Greg.
> >
> >>I would like to draw your attention to this document.  It contains
> >> a specification for an authenticated encryption mode.  It was
> >> designed fro use with AES, but, of course, it will work with any
> >> 128-bit block cipher.
> >>
> >>mode.  You can learn more about CCM and the other proposed modes at
> >> the NIST web site ( see
> >> http://csrc.nist.gov/encryption/modes/proposedmodes/ ).
> >>
> >>IEEE 802.11 has chosen to make CCM the mandatory to implement AES
> >> mode for wireless LAN encryption. IEEE 802.15 has also chosen CCM
> >> for use with personal area networks.  In my opinion, this success
> >> is due to the lack of a patent (or pending patent from the
> >> authors) on CCM.  I suspect that most of the members of this list
> >> are aware that other candidate authenticated encryption modes are
> >> encumbered.
> >>
> >>Informational RFC.  This looks like the appropriate group to review
> >> the document.
> >>
> >>Russ
> >>
> >Greg Rose                                       INTERNET:
> > [email-masked] Qualcomm Australia          VOICE:  +61-2-9817
> > 4188   FAX: +61-2-9817 5199 Level 3, 230 Victoria Road,            
> >    http://people.qualcomm.com/ggr/ Gladesville NSW 2111    232B
> > EC8F 44C6 C853 D68F  E107 E6BF CD2F 1081 A37C
>

-- 
Regards,
Uri-David
-=-=-<>-=-=-
<Disclaimer>