Subject: [lamps] draft-ietf-lamps-cms-aes-gmac-alg-04.txt - profibiting useing AES-GMAC with PBKDF2

From: "Brockhaus, Hendrik" <[email-masked]>
Date: Wed, 24 Mar 2021 13:29:35 +0000

Russ

While discussing some topics on CMP Algorithm, Hans explained that AES-GMAC must not be used as prf for PBKDF2.
We suggest to extend the Security Considerations in draft-ietf-lamps-cms-aes-gmac-alg as follows:

Old text:
   Within the scope of any content-authentication key, the AES-GMAC
   nonce value MUST be unique.  Use of a nonce value more than once
   allows an attacker to generate valid AES-GMAC authentication codes
   for arbitrary messages, resulting in the loss of authentication as
   described in Appendix A of [GCM].

New text:
   Within the scope of any content-authentication key, the AES-GMAC
   nonce value MUST be unique.  Use of a nonce value more than once
   allows an attacker to generate valid AES-GMAC authentication codes
   for arbitrary messages, resulting in the loss of authentication as
   described in Appendix A of [GCM]. If AES-GMAC is used as a  building 
   block in another algorithm (e.g. as a pseudo-random function), one
   must make sure that AES-GMAC is used only once in this algorithm.
   For instance, AES-GMAC MUST NOT be used as the pseudo-random
   function for PBKDF2.

Hendrik

---

From: Russ Housley <[email-masked]>
Date: Wed, 24 Mar 2021 10:48:34 -0400

Thanks for this addition.  I suggest a separate paragraph as follows:

   If AES-GMAC is used as a building block in another algorithm (e.g.,
   as a pseudo-random function), AES-GMAC MUST be used only one time by
   that algorithm.  For instance, AES-GMAC MUST NOT be used as the
   pseudo-random function for PBKDF2.

Since the IESG has already approved this document, I will reach out to Roman about how to include this.

Russ

> On Mar 24, 2021, at 9:29 AM, Brockhaus, Hendrik <[email-masked]> wrote:
> 
> Russ
> 
> _______________________________________________
> Spasm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/spasm

---

From: "Brockhaus, Hendrik" <[email-masked]>
Date: Wed, 24 Mar 2021 16:10:03 +0000

Thanks, looks good.

Hendrik

> Von: Russ Housley <[email-masked]>
> 
> https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf
> .org%2Fmailman%2Flistinfo%2Fspasm&amp;data=04%7C01%7Chendrik.brockha
> us%40siemens.com%7C3b3c713edbe74819e91c08d8eed3ea73%7C38ae3bcd95
> 794fd4addab42e1495d55a%7C1%7C0%7C637521941224431220%7CUnknown%
> 7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiL
> CJXVCI6Mn0%3D%7C1000&amp;sdata=%2BYA4kn0dTl%2FXupb97Hk%2FXaSm6
> wl0Ckw1YND%2FgRbue38%3D&amp;reserved=0

---

From: Roman Danyliw <[email-masked]>
Date: Fri, 26 Mar 2021 20:55:46 +0000

If anyone objects to this clarification please voice your concerns by March 30.

Roman

> -----Original Message-----
> From: Spasm <[email-masked]> On Behalf Of Brockhaus, Hendrik
> Sent: Wednesday, March 24, 2021 12:10 PM
> To: Russ Housley <[email-masked]>
> Cc: [email-masked]; [email-masked]
> Subject: Re: [lamps] draft-ietf-lamps-cms-aes-gmac-alg-04.txt - profibiting
> useing AES-GMAC with PBKDF2
> 
> Thanks, looks good.
> 
> Hendrik
> 
> > > While discussing some topics on CMP Algorithm, Hans explained that
> > > AES-
> > GMAC must not be used as prf for PBKDF2.
> > > We suggest to extend the Security Considerations in
> > > draft-ietf-lamps-cms-aes-
> > gmac-alg as follows:
> > >
> > > Old text: