Subject: Re: [IPsec] [Cryptography] Direct public confirmation from Dr. Rogaway (fwd)

From: Dan Harkins <[email-masked]>
Date: Wed, 03 Mar 2021 11:36:46 -0800

Faster and more secure seem to be compelling reasons. Those reasons are
probably more compelling for ESP than they are for IKE.

   The license for OCB always had some caveats like the code could not 
be used
for military purposes which is something of a nightmare for a 
manufacturer of
general purpose hardware/software. Considering how difficult it would be to
ensure that your product is never used by a military anywhere in the world,
that's probably enough of a reason for TLS to not support it. Remember how
long ECC was delayed for (imagined) IP reasons?

   IP is bad news. People don't want anything to do with partially 
encumbered
technology. Now this technology is not encumbered at all so, yea, let's 
do it.

   If an individual draft was to appear would the WG adopt it as a work 
item?

   regards,

   Dan.

On 2/28/21 1:47 PM, Yoav Nir wrote:
> IIRC the license has allowed OCB to be used for TLS for several years. 
> They haven’t taken it up. There are no AES-OCB ciphersuites 
> inhttps://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-4 
>
>
> So I’m wondering right with you: It has a theoretical advantage in 
> security and a measurable advantage in speed in software.  Neither 
> were compelling enough for anyone to bother adding it in TLS 
> ciphersuites.  Why should our conclusion be any different?
>
> Yoav
>
>
>> On 28 Feb 2021, at 22:35, Paul Wouters <[email-masked] 
>> <mailto:[email-masked]>> wrote:
>>
>>
>> So now that OCB is finally free, do we want to implement it? :)
>>
>> I'm honestly not sure if the improvements of AES-GCM are worth it.
>> I haven't heard of vulnerabilities in IKE/ESP wrt. IVs or counters.
>>
>> Paul
>>
>> ---------- Forwarded message ----------
>> Date: Sat, 27 Feb 2021 14:37:30
>> From: "Salz, Rich via cryptography" <[email-masked] 
>> <mailto:[email-masked]>>
>> To: "[email-masked] <mailto:[email-masked]>" 
>> <[email-masked] <mailto:[email-masked]>>
>> Subject: [Cryptography] Direct public confirmation from Dr. Rogaway
>>
>>
>> https://mailarchive.ietf.org/arch/msg/cfrg/qLTveWOdTJcLn4HP3ev-vrj05Vg/ :
>>
>>
>>
>> I can confirm that I have abandoned all OCB patents
>>
>> and placed into the public domain all OCB-related IP of mine.
>>
>> While I have been telling people this for quite some time, I don't
>>
>> think I ever made a proper announcement to the CFRG or on the
>>
>> OCB webpage. Consider that done.
>>
>>
>>
>> I hope people will use the scheme to do positive things.
>>
>>
>>
>> phil
>>
>> _______________________________________________
>> The cryptography mailing list
>> [email-masked] <mailto:[email-masked]>
>> https://www.metzdowd.com/mailman/listinfo/cryptography
>> _______________________________________________
>> IPsec mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/ipsec
>
>
> _______________________________________________
> IPsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipsec

-- 
"The object of life is not to be on the side of the majority, but to
escape finding oneself in the ranks of the insane." -- Marcus Aurelius

---

From: Graham Bartlett <[email-masked]>
Date: Wed, 3 Mar 2021 20:00:01 +0000

Hi Dan

Glad you replied to this, OCB seems to be a hot topic at the moment. There
seems to be some interest in this simply due to the potential speed
increase.

Would anyone know the potential % difference in speed compared to GCM ?

In summary I think it should be discussed.

cheers

On Wed, Mar 3, 2021 at 7:37 PM Dan Harkins <[email-masked]> wrote:

>   The license for OCB always had some caveats like the code could not be
> used
> for military purposes which is something of a nightmare for a manufacturer
> of
> technology. Now this technology is not encumbered at all so, yea, let's do
> it.
>
> security and a measurable advantage in speed in software.  Neither were
> compelling enough for anyone to bother adding it in TLS ciphersuites.  Why
> should our conclusion be any different?
>
> Yoav
>
>
> On 28 Feb 2021, at 22:35, Paul Wouters <[email-masked]> wrote:
>
>
> From: "Salz, Rich via cryptography" <[email-masked]>
> To: "[email-masked]" <[email-masked]>
> [email-masked]
> IPsec mailing [email-masked]://www.ietf.org/mailman/listinfo/ipsec
>
>
> --

---

From: Tero Kivinen <[email-masked]>
Date: Thu, 4 Mar 2021 14:38:01 +0200

Dan Harkins writes:
> If an individual draft was to appear would the WG adopt it as a work item?

Can't say what WG would decide, but I would support such work, and
would be willing to start a process to adding such item to charter if
WG feels that is something we want to do. 
-- 
[email-masked]

---

From: Dan Brown <[email-masked]>
Date: Thu, 4 Mar 2021 19:04:43 +0000

Deciding whether to use OCB sounds like a job for CFRG!

As I understand it, OCB2 is severely broken: https://eprint.iacr.org/2019/311

That said, OCB1 and OCB3 may be just fine, but a broken OCB2 is not a good sign.  All the more reason to defer to CFRG, unless you want to play Monty Hall problem.

Dan

From: IPsec <[email-masked]> On Behalf Of Dan Harkins
Sent: Wednesday, March 3, 2021 2:37 PM
To: [email-masked]
Subject: Re: [IPsec] [Cryptography] Direct public confirmation from Dr. Rogaway (fwd)

  The license for OCB always had some caveats like the code could not be used
for military purposes which is something of a nightmare for a manufacturer of
general purpose hardware/software. Considering how difficult it would be to
ensure that your product is never used by a military anywhere in the world,
that's probably enough of a reason for TLS to not support it. Remember how
long ECC was delayed for (imagined) IP reasons? 

  IP is bad news. People don't want anything to do with partially encumbered
technology. Now this technology is not encumbered at all so, yea, let's do it.

  regards,

  Dan.

IIRC the license has allowed OCB to be used for TLS for several years. They haven’t taken it up. There are no AES-OCB ciphersuites inhttps://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-4 

So I’m wondering right with you: It has a theoretical advantage in security and a measurable advantage in speed in software.  Neither were compelling enough for anyone to bother adding it in TLS ciphersuites.  Why should our conclusion be any different?

Yoav

On 28 Feb 2021, at 22:35, Paul Wouters <[email-masked] <mailto:[email-masked]> > wrote:

Paul

---------- Forwarded message ----------
Date: Sat, 27 Feb 2021 14:37:30
From: "Salz, Rich via cryptography" <[email-masked] <mailto:[email-masked]> >
To: "[email-masked] <mailto:[email-masked]> " <[email-masked] <mailto:[email-masked]> >
Subject: [Cryptography] Direct public confirmation from Dr. Rogaway

https://mailarchive.ietf.org/arch/msg/cfrg/qLTveWOdTJcLn4HP3ev-vrj05Vg/ <https://urldefense.proofpoint.com/v2/url?u=https-3A__mailarchive.ietf.org_arch_msg_cfrg_qLTveWOdTJcLn4HP3ev-2Dvrj05Vg_&d=DwMDaQ&c=yzoHOc_ZK-sxl-kfGNSEvlJYanssXN3q-lhj0sp26wE&r=qkpbVDRj7zlSRVql-UonsW647lYqnsrbXizKI6MgkEw&m=2DcLjYKtazJ6kYTZx5uowgB-qJRp6_C8W0rBOr7ZOUI&s=LZV-8STdDDeui1TmXz2JORn2wTtSrkJa_-l3hZK-AO8&e=>  :

phil

_______________________________________________
The cryptography mailing list
[email-masked] <mailto:[email-masked]> 
https://www.metzdowd.com/mailman/listinfo/cryptography <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.metzdowd.com_mailman_listinfo_cryptography&d=DwMDaQ&c=yzoHOc_ZK-sxl-kfGNSEvlJYanssXN3q-lhj0sp26wE&r=qkpbVDRj7zlSRVql-UonsW647lYqnsrbXizKI6MgkEw&m=2DcLjYKtazJ6kYTZx5uowgB-qJRp6_C8W0rBOr7ZOUI&s=_9IPM1exZqE6F4PLBAvpqDF-bHkBi5JPiUyq3eeyfwo&e=> 
_______________________________________________
IPsec mailing list
[email-masked] <mailto:[email-masked]> 
https://www.ietf.org/mailman/listinfo/ipsec <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_ipsec&d=DwMDaQ&c=yzoHOc_ZK-sxl-kfGNSEvlJYanssXN3q-lhj0sp26wE&r=qkpbVDRj7zlSRVql-UonsW647lYqnsrbXizKI6MgkEw&m=2DcLjYKtazJ6kYTZx5uowgB-qJRp6_C8W0rBOr7ZOUI&s=B4s3eO4jZ5UhqwAPEQu9SxQaSVWKuM4HcC1moozCyBc&e=> 

_______________________________________________
IPsec mailing list
[email-masked] <mailto:[email-masked]> 
https://www.ietf.org/mailman/listinfo/ipsec <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_ipsec&d=DwMDaQ&c=yzoHOc_ZK-sxl-kfGNSEvlJYanssXN3q-lhj0sp26wE&r=qkpbVDRj7zlSRVql-UonsW647lYqnsrbXizKI6MgkEw&m=2DcLjYKtazJ6kYTZx5uowgB-qJRp6_C8W0rBOr7ZOUI&s=B4s3eO4jZ5UhqwAPEQu9SxQaSVWKuM4HcC1moozCyBc&e=> 

----------------------------------------------------------------------
This transmission (including any attachments) may contain confidential information, privileged material (including material protected by the solicitor-client or other applicable privileges), or constitute non-public information. Any use of this information by anyone other than the intended recipient is prohibited. If you have received this transmission in error, please immediately reply to the sender and delete this information from your system. Use, dissemination, distribution, or reproduction of this transmission by unintended recipients is not authorized and may be unlawful.

---

From: Dan Harkins <[email-masked]>
Date: Thu, 04 Mar 2021 14:29:46 -0800

Hi Dan,

On 3/4/21 11:04 AM, Dan Brown wrote:
> That said, OCB1 and OCB3 may be just fine, but a broken OCB2 is not a 
> good sign.  All the more reason to defer to CFRG, unless you want to 
> play Monty Hall problem.
>
>

   CFRG already produced RFC 7253. That's really all they can
be expected to do. It's up to individual IETF WGs to define
how to use that cipher mode in their particular protocols.
That's where we come in.

   regards,

   Dan.

> Dan
>
> *From:* IPsec <[email-masked]> *On Behalf Of *Dan Harkins
> *Sent:* Wednesday, March 3, 2021 2:37 PM
> *To:* [email-masked]
> *Subject:* Re: [IPsec] [Cryptography] Direct public confirmation from 
> Dr. Rogaway (fwd)
>
>
>     IIRC the license has allowed OCB to be used for TLS for several
>     years. They haven’t taken it up. There are no AES-OCB ciphersuites
>         To: "[email-masked]
>         <mailto:[email-masked]>" <[email-masked]
>         https://mailarchive.ietf.org/arch/msg/cfrg/qLTveWOdTJcLn4HP3ev-vrj05Vg/
>         <https://urldefense.proofpoint.com/v2/url?u=https-3A__mailarchive.ietf.org_arch_msg_cfrg_qLTveWOdTJcLn4HP3ev-2Dvrj05Vg_&d=DwMDaQ&c=yzoHOc_ZK-sxl-kfGNSEvlJYanssXN3q-lhj0sp26wE&r=qkpbVDRj7zlSRVql-UonsW647lYqnsrbXizKI6MgkEw&m=2DcLjYKtazJ6kYTZx5uowgB-qJRp6_C8W0rBOr7ZOUI&s=LZV-8STdDDeui1TmXz2JORn2wTtSrkJa_-l3hZK-AO8&e=>
>         :
>
>
>
>         <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.metzdowd.com_mailman_listinfo_cryptography&d=DwMDaQ&c=yzoHOc_ZK-sxl-kfGNSEvlJYanssXN3q-lhj0sp26wE&r=qkpbVDRj7zlSRVql-UonsW647lYqnsrbXizKI6MgkEw&m=2DcLjYKtazJ6kYTZx5uowgB-qJRp6_C8W0rBOr7ZOUI&s=_9IPM1exZqE6F4PLBAvpqDF-bHkBi5JPiUyq3eeyfwo&e=>
>         <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_ipsec&d=DwMDaQ&c=yzoHOc_ZK-sxl-kfGNSEvlJYanssXN3q-lhj0sp26wE&r=qkpbVDRj7zlSRVql-UonsW647lYqnsrbXizKI6MgkEw&m=2DcLjYKtazJ6kYTZx5uowgB-qJRp6_C8W0rBOr7ZOUI&s=B4s3eO4jZ5UhqwAPEQu9SxQaSVWKuM4HcC1moozCyBc&e=>
>
>
>
> ------------------------------------------------------------------------
> This transmission (including any attachments) may contain confidential 
> information, privileged material (including material protected by the 
> solicitor-client or other applicable privileges), or constitute 
> non-public information. Any use of this information by anyone other 
> than the intended recipient is prohibited. If you have received this 
> transmission in error, please immediately reply to the sender and 
> delete this information from your system. Use, dissemination, 
> distribution, or reproduction of this transmission by unintended 
> recipients is not authorized and may be unlawful.

---

From: Yoav Nir <[email-masked]>
Date: Sat, 6 Mar 2021 00:06:58 +0200

> On 3 Mar 2021, at 21:36, Dan Harkins <[email-masked]> wrote:
> 
>  

Yes. If we were back in 2008 and figuring out which AEAD we should be using and they were both as unencumbered as they are now, maybe we would prefer OCB over GCM. 13 years later, every IPsec implementation has AES-GCM, so to add OCB to a product, it needs to be significantly better.  I haven’t seen recent numbers, but if I remember correctly, the performance difference was in the single-digit percentage points. It’s harder to quantify the security differences, but I don’t think they were compelling.  However, these arguments apply to a product, not necessarily to the protocol.  Adding this as an option for IPsec (and IKE) is just fine, whether vendors adopt it or not.

>   If an individual draft was to appear would the WG adopt it as a work item?

Up to the WG, but I would support it.

Yoav

>> IIRC the license has allowed OCB to be used for TLS for several years. They haven’t taken it up. There are no AES-OCB ciphersuites inhttps://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-4 <inhttps://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-4>
>> 
>>> On 28 Feb 2021, at 22:35, Paul Wouters <[email-masked] <mailto:[email-masked]>> wrote:
>>> 
>>> 
>>> From: "Salz, Rich via cryptography" <[email-masked] <mailto:[email-masked]>>
>>> To: "[email-masked] <mailto:[email-masked]>" <[email-masked] <mailto:[email-masked]>>
>>> https://mailarchive.ietf.org/arch/msg/cfrg/qLTveWOdTJcLn4HP3ev-vrj05Vg/ <https://mailarchive.ietf.org/arch/msg/cfrg/qLTveWOdTJcLn4HP3ev-vrj05Vg/> :
>>> 
>>>  
>>> 
>>> https://www.metzdowd.com/mailman/listinfo/cryptography <https://www.metzdowd.com/mailman/listinfo/cryptography>
>>> https://www.ietf.org/mailman/listinfo/ipsec <https://www.ietf.org/mailman/listinfo/ipsec>
>> 
>> 
>> 
>> https://www.ietf.org/mailman/listinfo/ipsec <https://www.ietf.org/mailman/listinfo/ipsec>
> 
> --