Subject: [AVTCORE] SRTP: Any work on more cryptoalgorithms?

From: Harald Alvestrand <[email-masked]>
Date: Tue, 1 Feb 2022 14:32:15 +0100

In a review of SRTP cryptoalgorithms done recently, we figured out that 
if we want to deploy a ciphersuite that:

- does not depend on SHA-1

- uses AES

- supports AEAD

there are only two possibilities: AEAD_AES_128_GCM and AEAD_AES_256_GCM

Both of these add 16 bytes of overhead per packet, which is a lot for an 
audio stream.

Is there anyone performing work to develop, evaluate or register a 
cryptosuite with reasonable properties and a lower per-packet overhead?

And of course .... if not known here, where should I ask?

Harald

---

From: Roman Shpount <[email-masked]>
Date: Wed, 2 Feb 2022 00:35:34 -0500

Designing a cipher suite that uses a shorter GCM authentication tag (64 or
32 bit) but re-keys more often can be trivially done.

At the risk of sounding silly, I never understood the requirement to use a
128-bit authentication tag with GCM. All that did was force people to use
SHA1 with the 32-bit tag, which, I think, is worse than 32-bit GCM.
_____________
Roman Shpount

On Tue, Feb 1, 2022 at 8:32 AM Harald Alvestrand <[email-masked]>
wrote:

> _______________________________________________
> Audio/Video Transport Core Maintenance
> [email-masked]
> https://www.ietf.org/mailman/listinfo/avt
>

---

From: Bernard Aboba <[email-masked]>
Date: Wed, 2 Feb 2022 13:22:01 -0800

It appears that the 128-bit authentication tag resulted in part from a
concern about the security of shorter tags.

See:
Public Comments on SP 800-38D, Recommendation for Block Cipher Modes of
Operation: Galois/Counter Mode (GCM) and GMAC (nist.gov)
<https://csrc.nist.gov/csrc/media/Projects/crypto-publication-review-project/documents/initial-comments/sp800-38d-initial-public-comments-2021.pdf>

(Note comment on security of 32 and 64-bit tags on Page 7).

Also:
GCM Update (nist.gov)
<https://csrc.nist.gov/csrc/media/projects/block-cipher-techniques/documents/bcm/comments/cwc-gcm/gcm-update.pdf>

---

From: Roman Shpount <[email-masked]>
Date: Wed, 2 Feb 2022 17:10:41 -0500

Both notes are circular in the sense that they reference RFC 7714 as the
reason why 128-bit tags are considered acceptable for real-time
communications.

32-bit SHA1 tags are currently used in bandwidth-constrained situations
instead, which is a lot less secure and more expensive to compute. I am not
100% sure how 64-bit GCM and 80-bit SHA1 tags compare, but I feel SHA-1
would be considerably less secure.

Essentially, if we are dealing with a low bandwidth channel (such as highly
compressed audio), 32-bit and 64-bit tags should provide sufficient
security, especially with frequent key updates. For high bandwidth
channels, longer tags are more appropriate. Providing correct
guidelines can be tricky, so I believe RFC authors recommended using long
tags in all cases for the sake of simplicity.
_____________
Roman Shpount

On Wed, Feb 2, 2022 at 4:22 PM Bernard Aboba <[email-masked]>
wrote:

>> Designing a cipher suite that uses a shorter GCM authentication tag (64
>> or 32 bit) but re-keys more often can be trivially done.
>>
>> At the risk of sounding silly, I never understood the requirement to use
>> a 128-bit authentication tag with GCM. All that did was force people to use

---

From: "Mo Zanaty (mzanaty)" <[email-masked]>
Date: Wed, 2 Feb 2022 22:23:31 +0000

This was debated on this list in 2015 when RFC 7714 was being drafted.
https://mailarchive.ietf.org/arch/msg/avt/VOAJlmbvKpIjOn706vzizocxv34/

I recall arguing for 64-bit tags, and being in the rough, due to the relevance/irrelevance of IPv6 jumbos (32-bit packet length).
https://mailarchive.ietf.org/arch/msg/avt/arF8ZTLGZwBd03vB7oVJrRePizE/

Mo

From: avt <[email-masked]> on behalf of Bernard Aboba <[email-masked]>
Date: Wednesday, February 2, 2022 at 4:22 PM
To: Roman Shpount <[email-masked]>
Cc: Harald Alvestrand <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: Re: [AVTCORE] SRTP: Any work on more cryptoalgorithms?

It appears that the 128-bit authentication tag resulted in part from a concern about the security of shorter tags.

See:
Public Comments on SP 800-38D, Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC (nist.gov)<https://csrc.nist.gov/csrc/media/Projects/crypto-publication-review-project/documents/initial-comments/sp800-38d-initial-public-comments-2021.pdf>

Also:
GCM Update (nist.gov)<https://csrc.nist.gov/csrc/media/projects/block-cipher-techniques/documents/bcm/comments/cwc-gcm/gcm-update.pdf>

On Tue, Feb 1, 2022 at 9:36 PM Roman Shpount <[email-masked]<mailto:[email-masked]>> wrote:
Designing a cipher suite that uses a shorter GCM authentication tag (64 or 32 bit) but re-keys more often can be trivially done.

At the risk of sounding silly, I never understood the requirement to use a 128-bit authentication tag with GCM. All that did was force people to use SHA1 with the 32-bit tag, which, I think, is worse than 32-bit GCM.
_____________
Roman Shpount

On Tue, Feb 1, 2022 at 8:32 AM Harald Alvestrand <[email-masked]<mailto:[email-masked]>> wrote:
In a review of SRTP cryptoalgorithms done recently, we figured out that
if we want to deploy a ciphersuite that:

- uses AES

- supports AEAD

Harald

_______________________________________________
Audio/Video Transport Core Maintenance
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/avt
_______________________________________________
Audio/Video Transport Core Maintenance
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/avt

---

From: "Mo Zanaty (mzanaty)" <[email-masked]>
Date: Wed, 2 Feb 2022 22:26:44 +0000

It was not for simplicity, it was security considerations debated on this list. Search the avt archives for GCM in 2015 for all the threads. I posted a few of the relevant ones in another reply.

Mo

From: avt <[email-masked]> on behalf of Roman Shpount <[email-masked]>
Date: Wednesday, February 2, 2022 at 5:11 PM
To: Bernard Aboba <[email-masked]>
Cc: Harald Alvestrand <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: Re: [AVTCORE] SRTP: Any work on more cryptoalgorithms?

Both notes are circular in the sense that they reference RFC 7714 as the reason why 128-bit tags are considered acceptable for real-time communications.

32-bit SHA1 tags are currently used in bandwidth-constrained situations instead, which is a lot less secure and more expensive to compute. I am not 100% sure how 64-bit GCM and 80-bit SHA1 tags compare, but I feel SHA-1 would be considerably less secure.

Essentially, if we are dealing with a low bandwidth channel (such as highly compressed audio), 32-bit and 64-bit tags should provide sufficient security, especially with frequent key updates. For high bandwidth channels, longer tags are more appropriate. Providing correct guidelines can be tricky, so I believe RFC authors recommended using long tags in all cases for the sake of simplicity.
_____________
Roman Shpount

On Wed, Feb 2, 2022 at 4:22 PM Bernard Aboba <[email-masked]<mailto:[email-masked]>> wrote:
It appears that the 128-bit authentication tag resulted in part from a concern about the security of shorter tags.

See:

Also:

- uses AES

- supports AEAD

Harald

---

From: Roman Shpount <[email-masked]>
Date: Wed, 2 Feb 2022 17:52:55 -0500

Mo,

Thank you for the pointer. I found
https://mailarchive.ietf.org/arch/browse/avt/?index=VOAJlmbvKpIjOn706vzizocxv34
especially illuminating.

I guess this means an alternative to GCM is needed for shorter tags in
bandwidth-constrained environments.
_____________
Roman Shpount

On Wed, Feb 2, 2022 at 5:26 PM Mo Zanaty (mzanaty) <[email-masked]>
wrote:

> It was not for simplicity, it was security considerations debated on this
> list. Search the avt archives for GCM in 2015 for all the threads. I posted
> a few of the relevant ones in another reply.
>
>
>
> Mo
>
>
>
> *From: *avt <[email-masked]> on behalf of Roman Shpount <
> [email-masked]>
> *Date: *Wednesday, February 2, 2022 at 5:11 PM
> *To: *Bernard Aboba <[email-masked]>
> *Cc: *Harald Alvestrand <[email-masked]>, "[email-masked]" <
> [email-masked]>
> *Subject: *Re: [AVTCORE] SRTP: Any work on more cryptoalgorithms?
>
>
>
> Essentially, if we are dealing with a low bandwidth channel (such as
> highly compressed audio), 32-bit and 64-bit tags should provide sufficient

---

From: "Mo Zanaty (mzanaty)" <[email-masked]>
Date: Wed, 2 Feb 2022 23:14:53 +0000

IMO, GCM small tags are fine for small packets, which is the real need. The argument was that small tags are not fine for big packets like IPv6 jumbos, which never made sense to me, since big packets can just use full tags, why try to chop 8 bytes out of a jumbo? But as I said, I was in the rough then, and suspect the same outcome if anyone attempts any 7714bis effort.

Mo

From: Roman Shpount <[email-masked]>
Date: Wednesday, February 2, 2022 at 5:53 PM
To: "Mo Zanaty (mzanaty)" <[email-masked]>
Cc: Bernard Aboba <[email-masked]>, Harald Alvestrand <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: Re: [AVTCORE] SRTP: Any work on more cryptoalgorithms?

Mo,

Thank you for the pointer. I found https://mailarchive.ietf.org/arch/browse/avt/?index=VOAJlmbvKpIjOn706vzizocxv34 especially illuminating.

I guess this means an alternative to GCM is needed for shorter tags in bandwidth-constrained environments.
_____________
Roman Shpount

On Wed, Feb 2, 2022 at 5:26 PM Mo Zanaty (mzanaty) <[email-masked]<mailto:[email-masked]>> wrote:
It was not for simplicity, it was security considerations debated on this list. Search the avt archives for GCM in 2015 for all the threads. I posted a few of the relevant ones in another reply.

Mo

From: avt <[email-masked]<mailto:[email-masked]>> on behalf of Roman Shpount <[email-masked]<mailto:[email-masked]>>
Date: Wednesday, February 2, 2022 at 5:11 PM
To: Bernard Aboba <[email-masked]<mailto:[email-masked]>>
Cc: Harald Alvestrand <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [AVTCORE] SRTP: Any work on more cryptoalgorithms?

See:

Also:

- uses AES

- supports AEAD

Harald

---

From: Roman Shpount <[email-masked]>
Date: Wed, 2 Feb 2022 18:42:36 -0500

I would guess that another concern would be caring out an attack by sending
spoofed RTP packets and determining that some of them get decoded by
looking at RTCP reports. This can be used to guess the key, and short tags
are more vulnerable to this kind of attack.

I would still think this is more secure than 32-bit SHA-1.
_____________
Roman Shpount

On Wed, Feb 2, 2022 at 6:14 PM Mo Zanaty (mzanaty) <[email-masked]>
wrote:

> IMO, GCM small tags are fine for small packets, which is the real need.
> The argument was that small tags are not fine for big packets like IPv6
> jumbos, which never made sense to me, since big packets can just use full
> tags, why try to chop 8 bytes out of a jumbo? But as I said, I was in the
> rough then, and suspect the same outcome if anyone attempts any 7714bis
> effort.
>
>
>
> Mo
>
>
>
> *From: *Roman Shpount <[email-masked]>
> *Date: *Wednesday, February 2, 2022 at 5:53 PM
> *To: *"Mo Zanaty (mzanaty)" <[email-masked]>
> *Cc: *Bernard Aboba <[email-masked]>, Harald Alvestrand <
> [email-masked]>, "[email-masked]" <[email-masked]>

---

From: Justin Uberti <[email-masked]>
Date: Wed, 2 Feb 2022 15:57:29 -0800

I think it's worth taking another run at this, given the computational
benefits of AES-GCM.

FWIW, I asked about this a while back, and the answer I got was that
truncation of AEAD tags significantly weakens their security. I can't find
the details on this at the moment, but it's discussed at a high level in
https://datatracker.ietf.org/doc/html/rfc7714#section-13.2.

On Wed, Feb 2, 2022 at 3:43 PM Roman Shpount <[email-masked]> wrote:

> I would guess that another concern would be caring out an attack by
> sending spoofed RTP packets and determining that some of them get decoded
> by looking at RTCP reports. This can be used to guess the key, and short
> tags are more vulnerable to this kind of attack.
>