Subject: RE: [Cfrg] draft-thomas-w7cipher-03.txt

From: "Stephen Thomas" <[email-masked]>
Date: Mon, 11 Nov 2002 11:34:43 -0500

Hi David,

To answer your earlier email first, I'll be happy to spend 5 minutes (or
more, if there's interest) on W7 at the CFRG meeting here in Atlanta. I
was planning to be there anyway.

Our application for W7 is link level encryption over a fiber optic
(point-to-multipoint Gigabit Ethernet) link. We use it in streaming mode
with relatively low frequency key changes. You're right that this
operation requires a reliable link, but we're fortunate to have that in
our application. (Otherwise, we really would be in a hopeless
situation!) We also take advantage of another characteristic of our
application and use the Ethernet FCS for message integrity checking.
(Encryption is applied AFTER the Ethernet FCS is generated, so we can
verify keystream synchronization and such by checking the FCS after
decryption by the recipient.) Of course, the environmental
characteristic that we lean on here is that we don't worry about
man-in-the-middle attacks. (Otherwise, we'd need a real MAC.)

Having said that, we certainly wouldn't want to constrain other uses of
W7 if it fits those other applications.

See you in Atlanta.

Stephen

> -----Original Message-----
> From: David A. Mcgrew [mailto:[email-masked]]
> Sent: Monday, 11 November 2002 11:03 AM
> To: Stephen Thomas; [email-masked]
> Cc: Deven Anthony; [email-masked]; [email-masked]
> Subject: RE: [Cfrg] draft-thomas-w7cipher-03.txt
> 
> 
> Steven,
> 
> I'm interested to see that you're pushing the envelope on low 
> gate-count,
> high-speed encryption.  I don't know of another cipher that 
> has the same
> performance parameters as those you cited.  I'd like to ask a 
> few basic
> questions about W7 and its intended use.
> 
> Is W7 intended to be used in continuous stream mode, with the 
> sender and
> receiver automatically remaining in synchronization, or in 
> packetized mode, with
> a per-packet key initialization step?   The latter mode is 
> perhaps more widely
> useful since it doesn't require a reliable transport, but 
> OTOH it can introduce
> vulnerabilities.  I'm thinking here of the example of the RC4 
> related-key
> weakness that turned into a complete failure of the cipher 
> when used in
> packetized mode by WEP.
> 
> What protocols will W7 be used in?   Is there a security 
> framework defined for
> these protocols?  In particular, I'm wondering about how 
> message authentication
> can be done that can keep up with W7!   The smallest MAC that 
> I'm aware of is
> the LFSR-hash (H. Krawczyk, "LFSR-based hashing and 
> authentication", Advances in
> Cryptology---Crypto '94, pages 129--139, 1994.), which I 
> expect would be even
> smaller than W7.  (Aside: I believe that the MAC has been 
> patented by IBM.)
> 
> David
> 
> > -----Original Message-----
> > From: [email-masked] [mailto:[email-masked]]On Behalf Of
> > Stephen Thomas
> > Sent: Friday, October 18, 2002 1:46 PM
> > To: [email-masked]
> > Cc: Deven Anthony; [email-masked]; [email-masked]
> > Subject: [Cfrg] draft-thomas-w7cipher-03.txt
> >
> >
> >
> > The -03 version of draft-thomas-w7cipher-03.txt has been 
> submitted for
> > publication. It may take a few days for the draft to show up in the
> > usual places, but it is no different than the -02 version 
> (other than
> > the dates). The previous draft was issued before the 
> formation of the
> > Crypto Forum Research Group, so CFRG members may not be aware of its
> > existence.
> >
> > The abstract:
> >
> >    This document specifies the W7 cipher algorithm. The W7 
> algorithm is
> >    a byte-wide, synchronous stream cipher optimized for efficient
> >    hardware implementation at very high data rates. It is a 
> symmetric
> >    key algorithm supporting key lengths of 128 bits. In 
> addition to the
> >    algorithm specification, this document contains test 
> vectors and a
> >    representative software implementation in the C language.
> >
> > The algorithm is in use today in IP-based optical 
> transmission systems,
> > and multiple, genetically distinct implementations have sucessfully
> > interoperated.
> >
> > In order to ensure an open, easily accessible specification for the
> > algorithm (in the tradition of MDx, RCx, CAST-x, MISTY, and 
> others), the
> > authors would like the IESG to consider publishing the draft as an
> > Informational RFC.
> >
> > The -01 version of the draft generated some discusion on 
> the sci.crypt
> > newsgroup. With apologies for the long URL, here is the thread.
> >
> > 
http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&th=22a0c2a31c1cc7b5&s
> eekm=d3a9d3a6.0204190946.289da9a5%40posting.google.com#link1
>
> The newsgroup discussion, as well as follow-on private emails, was
very
> helpful, and led to some minor changes in the -02 draft.
>
> Wave7 Optics has an IPR statement related to W7 on file with the IETF.
> It's available at http://www.ietf.org/ietf/IPR/WAVE7-OPTICS.txt
>
> If there is a CFRG meeting in Atlanta, I will be happy to participate
in
> any discussions regarding W7. (Wave7 Optics is headquartered in
> Atlanta.) As someone checking the pedigrees of the draft authors will
> note, though, I am very far from the crypto expert in the group. (That
> honor would go to Drs. Bersen and Gong.)
>
> Thanks for your attention,
>
> Stephen
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/cfrg

_______________________________________________
Cfrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/cfrg