Subject: [AVTCORE] Explicit IV in AES-GCM and AES-CCM

From: John Mattsson <[email-masked]>
Date: Thu, 24 Jul 2014 14:53:19 +0000

Reading draft-ietf-avtcore-srtp-aes-gcm again, it struck me that the construction should make use of an explicit IV/Nonce (as is done in RFC5288) instead of constructing the IV purely from RTP headers.

This would directly remove some of the remaining security issues in the draft:

                        “Note that
                         implicitly assumes that either the outgoing RTP
                         process is trusted to not attempt to repeat a
                         SEQ value, or that the encryption process
                         ensures that the SEQ number of the packets
                         presented to it are always incremented in the
                         proper fashion.  This is particularly important
                         for GCM since using the same SEQ value twice
                         compromises the authentication mechanism.  For
                         GCM, the SEQ and SSRC values used MUST either
                         be generated or checked by the SRTP
                         implementation, or by a module (e.g.  the RTP
                         application) that can be considered equally
                         trusted as the SRTP implementation.  While
                         [RFC3711] allows detecting SSRC collisions
                         after they happen, SRTP using GCM with shared
                         master keys MUST prevent SSRC collision from
                         happening even once.”

Saving a few bytes by constructing the IV from RTP headers may have been motivated in AES-CM and AES-f8 to make them work with some old legacy access networks, but is it not today.

Or to cite Kevin: “This avoids the problem at hand, plus it has the additional virtue of being the rational thing to do.”

Cheers,
John

JOHN MATTSSON
MSc Engineering Physics, MSc Business Administration and Economics
Ericsson IETF Security Coordinator
Senior Researcher, Security

Ericsson AB
Ericsson Research
Färögatan 6
SE-164 80 Stockholm, Sweden
Phone +46 10 71 43 501
SMS/MMS +46 76 11 53 501
[email-masked]<mailto:[email-masked]>
www.ericsson.com<http://www.ericsson.com/>

[http://www.ericsson.com/]<http://www.ericsson.com/>

This Communication is Confidential. We only send and receive email on the basis of the terms set out atwww.ericsson.com/email_disclaimer<http://www.ericsson.com/email_disclaimer>

---

From: Martin Thomson <[email-masked]>
Date: Thu, 24 Jul 2014 10:16:00 -0700

On 24 July 2014 07:53, John Mattsson <[email-masked]> wrote:

> Reading draft-ietf-avtcore-srtp-aes-gcm again, it struck me that the
> construction should make use of an explicit IV/Nonce (as is done in
> RFC5288) instead of constructing the IV purely from RTP headers.
>

There's a lot of talk about this in the TLS context as well.  Perhaps we
should let the outcome of the discussion of ChaCha20/Poly1305 to guide that
decision here.  AGL also expressed a desire to build a compact AES-GCM mode
that used the sequence number rather than the explicit IV.

As long as there is unique information in the header, then I have seen no
strong security arguments in favour of an explicit IV.  Given the space
savings, it seems that one is strictly better than the other.