Subject: [AVT] Comments on draft-ietf-avt-srtp-02.txt

From: [email-masked]
Date: Tue, 26 Feb 2002 15:32:13 +0200

Hi,

some questions and comments on draft-ietf-avt-srtp-02.txt:

(1)
In section 3.1:
"Each SRTP session requires the sender and receiver to maintain
cryptographic state information. This information is called the cryptographic context."

I guess that means that each of them (sender & receiver) needs to maintain one? 

(2)
In section 3.2:
"4. Encrypt the Encrypted Portion of the packet (see Section 4, for
the defined ciphers), using the encryption keys found in Step 3."

Encrypt the Encrypted Portion of the packet: Is it not so, that this portion 
first has to be encrypted, and after that it can be named 'Encrypted Portion'? 
Anyway this name 'Encrypted Portion' is used for the SRTP packet, and 
not RTP packet? Before a packet is entering transformation, is it not 
basically still RTP packet? Can we say that we are encrypting the 'Encrypted 
Portion' of the packet even though our packet is in this case still RTP packet 
and therefore doesn't have the encrypted portion yet? 
Same also for the authentication under Step 5.

(3)
In section 4.3.1:
"PRF_m^n(k_master, <label> || (index DIV key_derivation_rate) || 0x555...)
where <label> is a 4-bit constant (see below), key_derivation_rate is
as determined in the crypto context, and index is the packet index
(i.e. the 48-bit ROC || SEQ for SRTP). We then pad by 1010... to fill
the m-bit input size."

What is actually meant with the last sentence? 
0x555 is not equal to 1010. 
(same in  4.1.2.1: "The value of the key mask m is defined to be m = k_s || 0x555..5,
i.e. the salting key, appended by the binary pattern 0101.. to fill the entire desired key size, n_e.")

(4) 
In the draft there are some transformations which are default and which are non-default.
How would the sender select the non-default transformation (e.g. encryption) and let the receiver
know which one was selected?

Editorial Notes:

(1)
In section 3.1.1:
"The transport-independent parameters of the cryptographic context
consists of:"

The correct ways would be: 
	The cryptographic context consists of the following transport-independent parameters:
	The transport-independent parameters of the cryptographic context are:
	Or something similar...

Kind Regards,
       Eva

-----------------------
[email-masked]

_______________________________________________
Audio/Video Transport Working Group
[email-masked]
https://www1.ietf.org/mailman/listinfo/avt

---

From: Mats Näslund <[email-masked]>
Date: Wed, 27 Feb 2002 00:58:38 +0100

Hi Eva,

Thanks for the comments.

(I have some mail trouble with receiveing mails from the AVT list, 
so pardon if some of the SRTP co-authors already answered. However,
as you directed the mail to Elisabetta, who's on vacation, I will 
fill in for her and answer.)

In short, most of the things you mention has already been fixed
for SRTP verion 03, soon to be out.

>I guess that means that each of them (sender & receiver) needs to maintain one? 

Yes.

>first has to be encrypted, and after that it ca be named 'Encrypted Portion'? 

We have observed this and we will be clearer in the new version.

>0x555 is not equal to 1010. 

The new version will not have any "padding" at all.

>i.e. the salting key, appended by the binary pattern 0101.. to fill the entire desired key size, n_e.")

Well, I belive this *is* correct and is not changed in the new version.

>know which one was selected?

By means of key management. Please refer to our "MIKEY" MSEC WG draft.

>"The transport-independent parameters of the cryptographic context

Well, I guess we slipped on the keyboard here.... ;-) It should be 
"transform-independent parameters".

Thanks

/Mats