Subject: RE: [AVT] SRTP comments - AES-CM vs. AES-f8

From: Mats Näslund (ERA)<[email-masked]>
Date: Fri, 31 May 2002 21:39:35 +0200

Hi Martin

> -----Original Message-----
> From: Euchner Martin ICN M SR 3 [mailto:[email-masked]]
> Sent: den 31 maj 2002 10:09
> To: Euchner Martin ICN M SR 3; 'Mark Baugher'; 
> [email-masked]';
> [email-masked]'
> Cc: [email-masked]'
> Subject: RE: [AVT] SRTP comments - AES-CM vs. AES-f8
> 
> 
> Perhaps these questions have been overseen: Thus, let me ask again:
> 
> Still, there should be some reasoning in the security 
> consideration section
> explaining
> - What the security strength of AES-CM is over AES-f8 and 
> vice versa ? And

That is an excellent question!

Dave and Mark are basically right: there are no big differences.
If you take a look at the existing security proofs for the respective
modes, you can "play around" with some parameters and see what you get
(you can find references in the I-D). Basically, the security proofs provides
as forumulat, quantifying what security you have against adversaries who
are able to obtain a certain number of chosen plaintext bits. I.e., given
that the have Q known bits, you can see how much effort that is needed
to break the cipher.

Again, there are very small differences.

> what kind of security properties does AES-f8 feature that AES-CM can't
> provide?

Very few (and conversely).

> - Is AES-CM is not suitable in a mobile, 3G environment or do have 3G
> terminals have to implement both AES-CM as default and AES-f8 ?

The rationale for CM is (I guess) that it will be the "standard"
stream cipher mode in general. The reason we have f8 there is that 
we hope that there might be cases when some wirless (eg UMTS device) 
could re-use parts of an existing f8 implementation. Note though
that the standard use of f8 in UMTS is with another cipher, not AES.

Cheers

/Mats

_______________________________________________
Audio/Video Transport Working Group
[email-masked]
https://www1.ietf.org/mailman/listinfo/avt