Subject: [TLS] WG interest in draft-chudov-cryptopro-cptls-02.txt

From: Eric Rescorla <[email-masked]>
Date: Mon, 28 Nov 2005 11:03:27 -0800

I'd like to get some working group discussion on whether 
there's interest in pursuing the GOST cipher suites
draft-chudov-cryptopro-cptls-02.txt as a working group
document. In your responses, please indicate:

1. Whether you would like to see this as a WG document.
2. Whether you are willing to commit to reviewing it in
   future.

-Ekr

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: Russ Housley <[email-masked]>
Date: Mon, 28 Nov 2005 14:49:04 -0500

As written, the document needs the PRF agility that was discussed for 
TLS 1.2.  So, I would think that this document would be a good 
candidate for a ciphersuite using the non-mandatory-to-implement 
PRF.  Having one in and while developing TLS 1.2 sounds very desirable to me.

Russ

---

From: Dmitry Belyavsky <[email-masked]>
Date: Tue, 29 Nov 2005 17:40:25 +0300 (MSK)

Greetings!

On Mon, 28 Nov 2005, Russ Housley wrote:

> As written, the document needs the PRF agility that was discussed for TLS 1.2.
> So, I would think that this document would be a good candidate for a
> ciphersuite using the non-mandatory-to-implement PRF.  Having one in and while
> developing TLS 1.2 sounds very desirable to me.

What can you say about section 3.3 of draft-chudov-cryptopro-cptls-02.txt?
It describes a non-reasoned aberration from RFC 2246:

====================
   For all four cipher suites, the use of MAC is slighttly different
   from the one, described in section 6.2.3.1 of [TLS].  In [TLS], MAC
   is calculated from the following data:

     MACed_data[seq_num] = seq_num +
                           TLSCompressed.type +
                           TLSCompressed.version +
                           TLSCompressed.length +
                           TLSCompressed.fragment;

   These cipher suites use the same input for first record, but for each
   next record the input from all previous records is concatenated:

     MACed_data[0] + ... + MACed_data[n]
====================

-- 
SY, Dmitry Belyavsky (ICQ UIN 11116575)

---

From: "Gregory S. Chudov" <[email-masked]>
Date: Tue, 29 Nov 2005 20:52:30 +0300

Greetings.

I agree that it could be useful to add a paragraph, containing the reasoning 
for this.

IMIT_GOST28147 is not an HMAC, it is basicly a form of GOST28147 cipher.
To be robust to attacks based on timing and EMI analysis, one symmetric key
should not  be used for large quantities of plaintext, so the key meshing 
algorithm
from draft-popov-cryptopro-cpalgs-04.txt is applied.

This "abberation" can be rephrased in a following way: MACed_data[seq_num]
is MACed, using the cipher state, produced by processing the previous 
record.

Good luck!

----- Original Message ----- 
From: "Dmitry Belyavsky" <[email-masked]>
To: "Russ Housley" <[email-masked]>
Cc: <[email-masked]>
Sent: Tuesday, November 29, 2005 5:40 PM
Subject: Re: [TLS] WG interest in draft-chudov-cryptopro-cptls-02.txt

> Greetings!
...

---

From: Dmitry Belyavsky <[email-masked]>
Date: Wed, 30 Nov 2005 11:26:43 +0300 (MSK)

Greetings!

> from draft-popov-cryptopro-cpalgs-04.txt is applied.

Thank you, this paragraph provides enough information for me to understand
your design decision.

But the section 2 of draft-chudov-cryptopro-cptls-02.txt proposes two
cipher suites with GOSTR3411-based MAC. Is key meshing applied
for these cipher suites too or do they use usual HMAC? And what is MACed
data for them?

Thank you!

> is MACed, using the cipher state, produced by processing the previous record.
>
> Good luck!
>
> ----- Original Message ----- From: "Dmitry Belyavsky" <[email-masked]>

---

From: Nikos Mavrogiannopoulos <[email-masked]>
Date: Wed, 30 Nov 2005 13:05:52 +0100

> 2. Whether you are willing to commit to reviewing it in

I think it is nice to have alternatives, so I would like to see 
something like this in TLS. So my anwser would be yes in both
questions.

-- 
Nikos Mavrogiannopoulos

---

From: Dmitry Belyavsky <[email-masked]>
Date: Wed, 30 Nov 2005 15:13:10 +0300 (MSK)

Greetings!

> 2. Whether you are willing to commit to reviewing it in

I'm interested in pursuing the GOST cipher suites specification as a
working group document and would like to participate in reviewing it.

---

From: Ali Fessi <[email-masked]>
Date: Wed, 30 Nov 2005 13:43:42 +0100

Dear all,

can some one tell me if there is today any differences between TLS and 
SSL; or if SSL implementations (e.g. OpenSSL Version 0.9.7) are 
basically conform to the TLS standard + a couple of extensions (such as 
AES Cipher Suites, ECC Cipher Suites, also Kerberos Cipher suites?!)

Thanks in advance.
Ali
--
Ali Fessi
Phone: +49 - 7071 29534
University of Tuebingen

---

From: "Gregory S. Chudov" <[email-masked]>
Date: Wed, 30 Nov 2005 18:40:03 +0300

Greetings.

They use usual HMAC, and i think it makes sense
to use the standard scheme from TLS for them
(Null or standard stream cipher, ch. 6.2.3.1).

I think we can put it this way:

   Cipher suites TLS_GOST341094_WITH_NULL_GOSTR3411 and
   TLS_GOST34102001_WITH_NULL_GOSTR3411 use the same
   record payload protection scheme, as described in section 6.2.3.1
   of [TLS]:

    CipherSpec.hash_size = 32
    GenericStreamCipher.MAC = HMAC_GOSTR3411 (MACed_data[seq_num])

   Cipher suites TLS_GOST341094_WITH_GOST28147_OFB_GOST28147
   and TLS_GOST34102001_WITH_GOST28147_OFB_GOST28147 use
   IMIT_GOST28147 as MAC function. IMIT_GOST28147 is basicly
   a form of GOST28147 cipher. To be robust to attacks based on timing and
   EMI analysis, one symmetric key should not  be used for large quantities 
of
   plaintext, so the CryptoPro Key Meshing algorithm from [CPALGS],
   section 2.3.2, is applied to the MAC keys. Each record MAC is computed,
   using the cipher state resulting from processing the previous record, 
which
   is equivalent to computing the MAC from concatenation of all previous
   records:

    CipherSpec.hash_size = 4
    GenericStreamCipher.MAC = IMIT_GOST28147 (MACed_data[0] +
                                                                             
 ... + MACed_data[n])

Good luck and thanks for feedback.

----- Original Message ----- 
From: "Dmitry Belyavsky" <[email-masked]>
To: "Gregory S. Chudov" <[email-masked]>
Cc: <[email-masked]>
Sent: Wednesday, November 30, 2005 11:26 AM
Subject: Re: [TLS] WG interest in draft-chudov-cryptopro-cptls-02.txt

...
 ...