Subject: RE: [Cfrg] draft-thomas-w7cipher-03.txt

From: "Housley, Russ" <[email-masked]>
Date: Mon, 11 Nov 2002 16:45:58 -0500

Stephen:

IEEE 802.11 WEP encrypted the FCS too.  Actually, it has two, one on the 
plaintext and one of the ciphertext.  David Wagner showed that the CRC-32 
is insufficient in an environment where encryption is performed with XOR 
with a key stream.  One can XOR values into selective bits, then compute 
the CRC-32 of these changes and XOR the result into the encrypted 
CRC-32.  After decryption, the FCS on the modified plaintext will check!

I think you need a better integrity protection mechanism.

Russ

At 11:34 AM 11/11/2002 -0500, Stephen Thomas wrote:
>Hi David,
>
>To answer your earlier email first, I'll be happy to spend 5 minutes (or
>more, if there's interest) on W7 at the CFRG meeting here in Atlanta. I
>was planning to be there anyway.
>
>Our application for W7 is link level encryption over a fiber optic
>(point-to-multipoint Gigabit Ethernet) link. We use it in streaming mode
>with relatively low frequency key changes. You're right that this
>operation requires a reliable link, but we're fortunate to have that in
>our application. (Otherwise, we really would be in a hopeless
>situation!) We also take advantage of another characteristic of our
>application and use the Ethernet FCS for message integrity checking.
>(Encryption is applied AFTER the Ethernet FCS is generated, so we can
>verify keystream synchronization and such by checking the FCS after
>decryption by the recipient.) Of course, the environmental
>characteristic that we lean on here is that we don't worry about
>man-in-the-middle attacks. (Otherwise, we'd need a real MAC.)
>
>Having said that, we certainly wouldn't want to constrain other uses of
>W7 if it fits those other applications.
>
>See you in Atlanta.
>
>Stephen
>
>
> > -----Original Message-----
> > From: David A. Mcgrew [mailto:[email-masked]]
> > Sent: Monday, 11 November 2002 11:03 AM
> > To: Stephen Thomas; [email-masked]
> > Cc: Deven Anthony; [email-masked]; [email-masked]
> > Subject: RE: [Cfrg] draft-thomas-w7cipher-03.txt
> >
> >
> > Steven,
> >
> > I'm interested to see that you're pushing the envelope on low
> > gate-count,
> > high-speed encryption.  I don't know of another cipher that
> > has the same
> > performance parameters as those you cited.  I'd like to ask a
> > few basic
> > questions about W7 and its intended use.
> >
> > Is W7 intended to be used in continuous stream mode, with the
> > sender and
> > receiver automatically remaining in synchronization, or in
> > packetized mode, with
> > a per-packet key initialization step?   The latter mode is
> > perhaps more widely
> > useful since it doesn't require a reliable transport, but
> > OTOH it can introduce
> > vulnerabilities.  I'm thinking here of the example of the RC4
> > related-key
> > weakness that turned into a complete failure of the cipher
> > when used in
> > packetized mode by WEP.
> >
> > What protocols will W7 be used in?   Is there a security
> > framework defined for
> > these protocols?  In particular, I'm wondering about how
> > message authentication
> > can be done that can keep up with W7!   The smallest MAC that
> > I'm aware of is
> > the LFSR-hash (H. Krawczyk, "LFSR-based hashing and
> > authentication", Advances in
> > Cryptology---Crypto '94, pages 129--139, 1994.), which I
> > expect would be even
> > smaller than W7.  (Aside: I believe that the MAC has been
> > patented by IBM.)
> >
> > David
> >
> > > -----Original Message-----
> > > From: [email-masked] [mailto:[email-masked]]On Behalf Of
> > > Stephen Thomas
> > > Sent: Friday, October 18, 2002 1:46 PM
> > > To: [email-masked]
> > > Cc: Deven Anthony; [email-masked]; [email-masked]
> > > Subject: [Cfrg] draft-thomas-w7cipher-03.txt
> > >
> > >
> > >
> > > The -03 version of draft-thomas-w7cipher-03.txt has been
> > submitted for
> > > publication. It may take a few days for the draft to show up in the
> > > usual places, but it is no different than the -02 version
> > (other than
> > > the dates). The previous draft was issued before the
> > formation of the
> > > Crypto Forum Research Group, so CFRG members may not be aware of its
> > > existence.
> > >
> > > The abstract:
> > >
> > >    This document specifies the W7 cipher algorithm. The W7
> > algorithm is
> > >    a byte-wide, synchronous stream cipher optimized for efficient
> > >    hardware implementation at very high data rates. It is a
> > symmetric
> > >    key algorithm supporting key lengths of 128 bits. In
> > addition to the
> > >    algorithm specification, this document contains test
> > vectors and a
> > >    representative software implementation in the C language.
> > >
> > > The algorithm is in use today in IP-based optical
> > transmission systems,
> > > and multiple, genetically distinct implementations have sucessfully
> > > interoperated.
> > >
> > > In order to ensure an open, easily accessible specification for the
> > > algorithm (in the tradition of MDx, RCx, CAST-x, MISTY, and
> > others), the
> > > authors would like the IESG to consider publishing the draft as an
> > > Informational RFC.
> > >
> > > The -01 version of the draft generated some discusion on
> > the sci.crypt
> > > newsgroup. With apologies for the long URL, here is the thread.
> > >
> > >
>http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&th=22a0c2a31c1cc7b5&s
> > eekm=d3a9d3a6.0204190946.289da9a5%40posting.google.com#link1
> >
> > The newsgroup discussion, as well as follow-on private emails, was
>very
> > helpful, and led to some minor changes in the -02 draft.
> >
> > Wave7 Optics has an IPR statement related to W7 on file with the IETF.
> > It's available at http://www.ietf.org/ietf/IPR/WAVE7-OPTICS.txt
> >
> > If there is a CFRG meeting in Atlanta, I will be happy to participate
>in
> > any discussions regarding W7. (Wave7 Optics is headquartered in
> > Atlanta.) As someone checking the pedigrees of the draft authors will
> > note, though, I am very far from the crypto expert in the group. (That
> > honor would go to Drs. Bersen and Gong.)
> >
> > Thanks for your attention,
> >
> > Stephen
> > _______________________________________________
> > Cfrg mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/cfrg
>
>_______________________________________________
>Cfrg mailing list
>[email-masked]
>https://www1.ietf.org/mailman/listinfo/cfrg
_______________________________________________
Cfrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/cfrg