Subject: Re: FW: Last Call: The AES Cipher Algorithm in the SNMP's User-based Security Model to Proposed Standard

From: Matjaz Vrecko <[email-masked]>
Date: Wed, 02 Apr 2003 19:45:40 +0200

Hello,

As promised last week, MG-SOFT provides the updated SNMPv3 agent
on-line in order to expose it for interoperability tests with
other SNMPv3 implementations supporting USM module extended with
the CFB-AES-128 privacy protocol, as specified in the
draft-blumenthal-aes-usm-05.txt Internet draft.

SNMPv3 security parameters for accessing the agent on the Internet
are given on our web site at http://www.mg-soft.com/snmpv3.html

So far we have successfully tested our implementation with Net-SNMP
v5.0.8. MG-SOFT's WinSNMP development team is eager to receive any
comments with respect to the behavior of the above mentioned SNMPv3
agent provided for interoperability tests.

Best regards,

Matjaz

Matjaz Vrecko wrote:
> Hello Bert,
> 
> This week MG-SOFT implemented AES and, according to Uri's draft,
> sucesfully extended the USM module in our SNMPv3 engine. Early
> next week we will make available our SNMPv3 agent on-line on
> the Internet for interoperability tests with other implementations
> (once the agent will be on-line, I will post exact access
> parameters).
> 
> Best regards till then,
> 
> Matjaz
> 
> Wijnen, Bert (Bert) wrote:
> 
>> SNMPv3 supporters,
>> pls review and post your comments (if any)as requested.
>>
>> Statements of: I have read it and think it is "good stuff"
>> are welcome too
>>
>> Thanks,
>> Bert
>> -----Original Message-----
>> From: The IESG [mailto:[email-masked]]
>> Sent: dinsdag 25 maart 2003 20:52
>> Subject: Last Call: The AES Cipher Algorithm in the SNMP's User-based
>> Security Model to Proposed Standard
>>
>>
>>
>> The IESG has received a request to consider The AES Cipher Algorithm 
>> in the SNMP's User-based Security Model 
>> <draft-blumenthal-aes-usm-05.txt> as a Proposed Standard.  This has 
>> been reviewed in the IETF but is not the product of an IETF Working 
>> Group.
>>
>> The IESG plans to make a decision in the next few weeks, and solicits
>> final comments on this action.  Please send any comments to the 
>> [email-masked] or [email-masked] mailing lists by 2003-4-25.
>>
>> Files can be obtained via 
>> http://www.ietf.org/internet-drafts/draft-blumenthal-aes-usm-05.txt
>>
>>
> 

-- 
Matjaz Vrecko
MG-SOFT Corporation, Strma ulica 8, SI-2000 Maribor, Slovenia
Internet: http://www.mg-soft.si/  E-mail: <[email-masked]>
Phone: +386 2 2506565, Fax: +386 2 2506566

---

From: Jochen Katz <[email-masked]>
Date: Wed, 02 Apr 2003 23:14:06 +0200

Hi,

> agent provided for interoperability tests.

I could contact your agent using the current SNMP++ with both sha / md5 
and aes128.

Regards,
   Jochen

---

From: Wes Hardaker <[email-masked]>
Date: Mon, 21 Apr 2003 16:39:22 -0700

>>>>> On Wed, 26 Mar 2003 00:04:48 +0100, "Wijnen, Bert (Bert)" <[email-masked]> said:

Bert> SNMPv3 supporters, pls review and post your comments (if any)as
Bert> requested.

Bert> Statements of: I have read it and think it is "good stuff" are
Bert> welcome too

"good stuff" (but needs a fair amount of editing).  I implemented an
earlier version of the draft in 2 packages and it's still compliant
with the most current (though the implementation I based my work on
also supported the 192 and 256 versions of the same algorithm.

I have a number of commends/questions/concerns/editorial-catches,
which I'll list here (I've removed all the editorial catches that
other people already made.  IMHO, the entire document needs to be
re-proofread by all the authors especially after all the grammatical
changes that people have caught and found):

Concerns/Questions/Comments:

 - 1.1: The 3rd paragraph says the AES privacy protocol MAY be used
   with the authentication protocols in ... RFC3414.  Obviously, it
   may be used with more (future-defined) protocols as well and you
   may want to change the wording to reflect this.  You do mention it
   later in the document, however, but if you're going to cover it in
   both places you should have them both state the same thing (and the
   first statement made of this type should always be the most
   informative).

 - 1.3: My are you recommending that a 12 byte [should be "octets by
   the way] minimum password be used (don't get me wrong, I agree that
   longer is better).  Was 12 chosen arbitrarily (as opposed to 16 or
   24 or ...)?  I guess the real question is that if RFC3414 says 8
   bytes is enough for DES, then you should offer a reason why 12 is
   needed for AES (of course neither 8 nor 12 come anywhere near the
   potential entropy of a truly random key).  (Actually, the entropy
   of the authentication algorithms is more critical in my mind).

 - 1.3: I'd used the word "prohibited" instead of "limited" with
   respect to password sharing.

 - 1.3: I'd add a 3rd bullet: "Implementations SHOULD support the use
   of randomly generated master keys as a superior form of security."
   or something like that.  Truly the entropy in a password sucks, so
   I'd at least recommend the use of true random keys when possible.

 - 2: This really needs a full MIB definition, not just a segment.
   This section and the segment seems to imply that RFC3414 is going
   to be modified and have this stuck in it?  I don't think that would
   fly.

 - 3.1: "The secret value is shared by all SNMP engines authorized to
   originate messages on behalf of the appropriate user."  This is not
   true and is a bad statement to make from security prospective.
   1) The key has nothing to do with authorization, and the wording
      choices seems to imply that it might.
   2) The key dose *not* need to be shared with engines that may only
      need to send noAuthNoPriv or authNoPriv messages.  Your sentence
      implies that all engines using the given user should have the
      privacy key, which is not true and implies a greater secrecy
      sharing that is needed for some situations.

 - 3.1.1.2 - 3.1.1.4: if these are standard sizes suggested by
   [AES-MODE], say so in the document.

 - 3.1.2: "of the generating SNMP engine's 32-bit snmpEngineBoots, the
   SNMP engine's 32-bit snmpEngineTime, and a lcal 64 bit integer".
   This is not correct.  "generating SNMP engine" should be
   "authoritative SNMP engine".  Since management applications will
   not be transmitting their (local) boots/time values, and the entire
   IV is not transmitted you must use the boots and time values that
   are always known to both parties.  This means only the
   authoritative engine's boots/time values can be used unless you
   change the contents of the msgPrivacyParameters to include the full
   IV (which, of course, I don't recommend for octet-saving reasons).

 - 3.1.2: "An implementation can use any method to vary the value of
   the IV ..." IV => integer.  Since the boots and time are not put
   into the privacy field, only the integer can be varied in an
   arbitrary manner.

 - 3.1.2: I'd put in a note mentioning that multiple managers
   communicating with a single authoritative engine within a second
   can cause a duplicate IV to be used if they both (accidentally)
   use the same 64 bit integer value [the probability of such a
   problem is low, though birthday statistics drop this a bit more.  I
   posted an analysis of this a few months ago.].

 - 3.1.3, 3.1.4: an ASCII diagram would be nice for the people that
   aren't familiar with CFB mode (if you're going to describe it then
   you might as well generate the diagrams for it).

 - 3.2.1: you also need to know the authorization algorithm for the
   user, since it's used to generate the localized key.  And you might
   as well throw in the encryption algorithm just to check that it's
   the right one ;-)

 - 4: You should mention key entropy here since you talk about it
   earlier.  Additionally, I'd refer the reader to RFC3414 explicitly
   since the USM specific implications are there.

 - 4: you reference [CRYTPO-B] as a document that describes the need
   for a unique IV value.  However, I don't think that document is the
   right reference.  That document describes plain-text analysis and
   attacks of DES when operating in CBC mode.  CFB mode, which is used
   by your document, is quite different from CBC mode in its use of an
   IV and thus I don't think the statements made in that paper about
   unique IV requirements properly support your statements within your
   own document.  [since the author of the paper in question is also
   the reviewing security AD, maybe he'll have further comments on the
   subject?].

Editorial ('*' pairs mark changed parts of sentences):

 - General: You use "Symmetric Encryption Protocol" in many places.
   Why is it capitalized?  It really shouldn't be, IMO.  The same goes
   fore "Cipher Algorithm".

 - 1.  remove the ()s around the word "initial".
 - 1. "Model, however, allows" (add the commas)
 - 1.1 protocol for *the* USM based
 - 1.3: It is worth *remembering* that ... password *or non-localized key* is
   disclosed ...
 - 1.3: the sentence suffix "in this case" isn't needed.
 - 3: alternative to the *DES* privacy protocol
 - 3.1: of the message that *will* be encrypted *in an SNMP message*.
 - 3.1.1: contain description*s* of the revlevent
 - 3.1.2: satisfy *this* requirement *[above]*.
 - 3.1.3, 3.1.4: "r is less *than* or equal to 128"
 - 3.2.1: MUST be *greater than or equal to* 128 bits (earlier you
   stated that you strip off the first 128 bits of a longer key, but
   here you state that a 128 bit length is mandatory).
 - 3.2.2 privacy key is *[delete normally]* different
 - 3.2.2, 3.2.3: for readability, I'd either use a English phrase for
   both of these or use msgPrivacyParameters for 3.2.4.
 - 3.2.4.1, 3.2.4.2: passes the *(localized)* secret key
 - 3.3: for the AES privacy protocol *for SNMP's User-based Security Model*
 - 3.3.1 step 1: *en*cryptKey (which is the full name the ASI has in
   the argument list).
 - 3.3.2 step 3: *de*cryptKey (ditto)

-- 
Wes Hardaker
Network Associates Laboratories

---

From: Daniel Chuang <[email-masked]>
Date: Mon, 28 Apr 2003 11:23:51 -0700

Hi, everyone,

>Bert> Statements of: I have read it and think it is "good stuff" are

I have one simple question on this draft, why the aes cfb mode is chosen
instead of cbc mode ?

thanks,
Daniel

---

From: Uri Blumenthal <[email-masked]>
Date: Mon, 28 Apr 2003 15:52:19 -0400

> I have one simple question on this draft, why the aes cfb mode is chosen

Because of its properties, of course.

1. Preserves the size of the plaintext (CBC would increase it).
2. Has error propagation within one block (like CBC).
3. Has chaining dependency (reordering ciphertext blocks affects
    decryption, like CBC).
4. Uses AES crypto engine in Encryption mode only (no need to
    implement AES_decrypt).