Subject: RE: [AVT] SRTP comments - AES-CM vs. AES-f8

From: Euchner Martin ICN M SR 3 <[email-masked]>
Date: Fri, 31 May 2002 10:08:30 +0200

Perhaps these questions have been overseen: Thus, let me ask again:

Still, there should be some reasoning in the security consideration section
explaining
- What the security strength of AES-CM is over AES-f8 and vice versa ? And
what kind of security properties does AES-f8 feature that AES-CM can't
provide?
- Is AES-CM is not suitable in a mobile, 3G environment or do have 3G
terminals have to implement both AES-CM as default and AES-f8 ?

With kind regards

Martin Euchner.
-----------------------------------------------------------------------
| Dipl.-Inf.                     Rapporteur Q.G/SG16
| Martin Euchner                 Phone: +49 89 722 55790
| Siemens AG.....................Fax  : +49 89 722 47713
| ICN M SR 3                     mailto:[email-masked]
|                                mailto:[email-masked]
| Hofmannstr. 51                 Intranet:
http://intranet.icn.siemens.de/marketing/cs27/topics/security/
| D-81359 Muenchen               Internet: http://www.siemens.de/
| __________________
| Germany     
-----------------------------------------------------------------------

 -----Original Message-----
From: 	Euchner Martin  ICN M SR 3  
Sent:	Wednesday, May 29, 2002 1:55 PM
To:	'Mark Baugher'; [email-masked];
[email-masked]'; Euchner Martin  ICN M SR 3
Cc:	[email-masked]
Subject:	RE: [AVT] SRTP comments

>  - Same is with the calculation of IV for the encryption/decryption; if 
> 4.1.1 is named "AES in Counter Mode" it means that here just pure AES-CM 
> should be explained, and all SRTP encryption specific stuff (like 
> calculation of IV for encryption/decryption) should be somewhere else?

It is important that the AES-CTR specification be read first.  I think it's 
best to avoid repeating that in SRTP since this repetition can lead to 
mistakes and confusion. Personally, I found 
http://csrc.nist.gov/encryption/modes/workshop1/papers/lipmaa-ctr.pdf to be 
helpful, though it does not appear among our references.  Perhaps it should.

MEU:>
Yes I agree, that mentioned NIST document provides some useful reasoning;
let's add it to the informal references.

More generally, I found references [ES3D] and [ES3E] not that helpful in
understanding UMTS-f8 mode.

However, I found the following two references more comprehensive and useful
and I recommend adding them to the informal references of the SRTP spec.

3GPP TS 35.201 V3.1.1 (2001-07)
Technical Specification
3rd Generation Partnership Project;
Technical Specification Group Services and System Aspects;
3G Security;
Specification of the 3GPP Confidentiality
and Integrity Algorithms;
Document 1: f8 and f9 Specification
(Release 1999)
http://www.3gpp.org/tb/other/algorithms/35201-311.pdf

3GPP KASUMI Evaluation Report
Public Report
3rd Generation Partnership Project;
Security Algorithms Group of Experts (SAGE);
Report on the Evaluation of 3GPP Standard
Confidentiality and Integrity Algorithms
(SAGE version 2.0)
http://www.3gpp.org/tb/other/algorithms/KASUMI_Eval_rep_v20.pdf

Still, there should be some reasoning in the security consideration section
explaining
- What the security strength of AES-CM is over AES-f8 and vice versa ? And
what kind of security properties does AES-f8 feature that AES-CM can't
provide?
- Is AES-CM is not suitable in a mobile, 3G environment or do have 3G
terminals have to implement both AES-CM as default and AES-f8 ?

With kind regards

Martin Euchner.
-----------------------------------------------------------------------
| Dipl.-Inf.                     Rapporteur Q.G/SG16
| Martin Euchner                 Phone: +49 89 722 55790
| Siemens AG.....................Fax  : +49 89 722 47713
| ICN M SR 3                     mailto:[email-masked]
|                                mailto:[email-masked]
| Hofmannstr. 51                 Intranet:
http://intranet.icn.siemens.de/marketing/cs27/topics/security/
| D-81359 Muenchen               Internet: http://www.siemens.de/
| __________________
| Germany     
-----------------------------------------------------------------------

_______________________________________________
Audio/Video Transport Working Group
[email-masked]
https://www1.ietf.org/mailman/listinfo/avt

---

From: Mark Baugher <[email-masked]>
Date: Fri, 31 May 2002 06:32:59 -0700

hi Martin
   I don't think that there are significantly different
security properties between the two ciphers.  I
tend to see this as splitting hairs.  But in a
practical sense, supporting multiple ciphers
enables SRTP for multiple environments where a particular
protocol implementation is destined to use a particular
cipher for reasons that don't necessarily have to do
with security.  The reasons could be arbitrary or
political.  I'd like to hear what David and Mats
have to say about this.  But I don't think that we
need to consider this topic in the security
considerations section.

Mark

---

From: "David R. Oran" <[email-masked]>
Date: Fri, 31 May 2002 09:44:43 -0400

I agree with Mark. Giving guidance about which ciphers to use and why in 
the SRTP spec is going beyond what is needed to tell implementers how to 
build interoperable implementations of the protocol with correct mapping of 
the crypto transform(s) onto the bits on the wire.

I also suspect crafting text would result in an endless discussion among 
crypto experts about the pro's and con's involved and whether they apply to 
the low-bandwidth wireless environment for audio, or the gigabit 
envinonment for HDTV video, etc.

One of the strengths of SRTP is its broad applicability and its ability to 
accommodate multiple crypto algorithms.

Dave.

--On Friday, May 31, 2002 6:32 AM -0700 Mark Baugher <[email-masked]> 
wrote:

>> Still, there should be some reasoning in the security consideration
>> section explaining
>> - What the security strength of AES-CM is over AES-f8 and vice versa ?
>> And what kind of security properties does AES-f8 feature that AES-CM
>> can't provide?
>> > 4.1.1 is named "AES in Counter Mode" it means that here just pure
>> > AES-CM should be explained, and all SRTP encryption specific stuff
>> > (like calculation of IV for encryption/decryption) should be somewhere
>> > else?
>>
>> It is important that the AES-CTR specification be read first.  I think
>> it's best to avoid repeating that in SRTP since this repetition can lead
>> to mistakes and confusion. Personally, I found
>> http://csrc.nist.gov/encryption/modes/workshop1/papers/lipmaa-ctr.pdf to
>> be helpful, though it does not appear among our references.  Perhaps it
>> should.
>>
>> MEU:>
>> However, I found the following two references more comprehensive and
>> useful and I recommend adding them to the informal references of the
>> SRTP spec.
>>
>> Still, there should be some reasoning in the security consideration
>> section explaining
>> - What the security strength of AES-CM is over AES-f8 and vice versa ?
>> And what kind of security properties does AES-f8 feature that AES-CM
>> can't provide?

-----------------------------------------------------------
David R. Oran                   Phone/Fax: +1 978 264 2048
Cisco Systems                   VoIP: +1 408 571 4576
7 Ladyslipper Lane              Email: [email-masked]
Acton, MA 01720