Subject: Re: [AVT] RTP padding, part 2 (RFC3550)

From: Andrei Iarus <[email-masked]>
Date: Mon, 14 Jul 2008 12:13:30 -0700 (PDT)

Hello Magnus,
Yes, you have right. But I was just thinking that this way one could avoid one possibility. So mainly a develeoper should be concerned about the information available to the an attacker or just use authentication.
Thank you for your precious reply,
Andrei

----- Original Message ----
From: Magnus Westerlund <[email-masked]>
To: Andrei Iarus <[email-masked]>
Cc: Audio Video IETF group <[email-masked]>
Sent: Monday, July 14, 2008 11:03:13 AM
Subject: Re: [AVT] RTP padding, part 2 (RFC3550)

Hi Andrei,

When it comes to RTP security there is several cases when there will be 
known plain text in the encrypted payload. Thus any encryption transform 
for RTP will need to have enough cipher strength to handle breaking 
attempts with known plain-text.

Changing the padding mechanism will not gain anything, as there are 
other parts of the different payload formats that can similarly be used 
when verifying attacks against the cipher.

Best Regards

Magnus

Andrei Iarus skrev:
> Hello,
>  
> Daniele Renzi had in his last email some questions regarding the RTP 
> padding standard.
> For details: http://www.ietf.org/mail-archive/web/avt/current/msg08938.html
>  
> If the P bit in the RTP header is 1, then the last byte in the payload 
> specifies the number of padded bytes, and the padded bytes are requested 
> by standard to be 0 (except the last one).
>  
> Serge Vaudenay presents in his work "Security Flaws Induced by CBC 
> Padding - Applications to SSL, IPSEC, WTLS..." a side-channel attack in 
> which are used padding-schemes whose correctness can be verified and its 
> checking result is available to the attacker. The Padding scheme 
> requested in RTP can be verified, and if the attacker has access to the 
> result of padding correctness checking, the ciphertext can be very 
> effectively decrypted.
>  
> Also there is specified, that if the plaintext is padded with random 
> bytes (except the last one), the attack would decrypt only the last byte.
>  
> Of course, in a multimedia transmission a bad-padded payload shouldn't 
> generate any reaction, but one cannot be sure of this.
>  
> Now my question/request for some comments is:
> Isn't better the random padding?
>  
> SRTP uses CTR as the mode of operation in encryption (that does not 
> request message padding), but the problem is: does RTP standard "force" 
> an encryption profile to avoid CBC?
>  
> Thank you for your valuable answers,
> Andrei.
> 
> 
> ------------------------------------------------------------------------
> 
> _______________________________________________
> Audio/Video Transport Working Group
> [email-masked]
> https://www.ietf.org/mailman/listinfo/avt

-- 

Magnus Westerlund

IETF Transport Area Director & TSVWG Chair
----------------------------------------------------------------------
Multimedia Technologies, Ericsson Research EAB/TVM
----------------------------------------------------------------------
Ericsson AB                | Phone +46 8 4048287
Färögatan 6                | Fax  +46 8 7575550
S-164 80 Stockholm, Sweden | mailto: [email-masked]
----------------------------------------------------------------------

_______________________________________________
Audio/Video Transport Working Group
[email-masked]
https://www.ietf.org/mailman/listinfo/avt