Subject: Re: [Cfrg] SRTP with SHA2?

From: Jon Callas <[email-masked]>
Date: Fri, 1 Jul 2011 15:27:30 -0700

On Jun 30, 2011, at 10:40 AM, Severns-Williams, Christine E (Christine) wrote:

> Hi All,
>   I’m not sure this is really the right mail list for this question.  But I see SHA2 being added to many security protocols (IPsec, TLS, etc) and discussion of other algorithms fading such as MD5.
>  
> I know SRTP supports AES-CM (128, 192, 256), AES-f8, and there is a draft for AES-CCM and AES-GCM (128 and 256).
>  
> Has anyone considered or is looking at using/adding SHA2 to the SRTP protocol?     Just curious.
>  
> I know the digest size is larger but it could still be truncated. 

You could, but there's no real need, and a number of reasons not to.

SRTP uses HMAC-SHA1 for integrity, and even provides for truncated integrity. If you believe that 80 bits of security is enough and that lots of times 32 bits is fine, then SHA256 is overkill. HMACs don't have the weaknesses that a straight hash does. You don't gain anything by using a truncated SHA256, security-wise.

(The truncated integrity is reasonable in many applications, particularly those where the payload is simply media. If the media has other integrity checks in it, even better. Suppose, for example, that the total payload was audio on the X codec, and if the X codec gets thrown into a bogus state, it will discard the packet. In this case, not only does the codec supply secondary authentication, but should a bad packet actually be inserted into the media stream, the only effect of that is an audio glitch. Almost certainly that glitch will just be a blip of noise.)

However, SHA256 is slower than SHA1, and since you're using it in an HMAC, you're having to do two hashes. That's big, from a performance point of view.

In many environments, the lion's share of the crypto cost for SRTP is that SHA1 HMAC. It is often over 2/3 of the total cost. Switching to SHA256 could bring the integrity cost to 80% or more of the total crypto cost, as well as driving it up, not down.

The real need for SRTP is to find an integrity check that's faster. That's something that ZRTP (RFC 6189) does. (Full disclosure: I'm a ZRTP co-author.) Some ZRTP implementations found that 75% of the cost of the crypto was that HMAC. So ZRTP provides the option to use the one-pass MAC feature of the Skein-512 hash function, which is one of the SHA3 finalists. (Full disclosure: I'm a Skein co-author, as well.) Not only is Skein-512 faster than SHA1, often running at 2/3 the speed of SHA1, but the one-pass MAC means you're only doing one hash, not two. That means that a Skein-MAC has only 1/3 the cost of HMAC-SHA1! It also has at least as good security as SHA256, so you get both better security and better performance.

(In the name of the algorithm, the -512 refers to the internal state size of Skein, not the output size. All three variants of Skein (256, 512, 1024) can have any length output. When you might want whatever internal state size is a long discussion that I could bore you at great length on. I believe that Skein-512 is adequate for any reasonable use.)

	Jon