Subject: [Cfrg] [Fwd: I-D Action:draft-c1222-transport-over-ip-04.txt]

From: Sean Turner <[email-masked]>
Date: Tue, 13 Jul 2010 12:09:21 -0400

Has anybody reviewed ANSI C12.22 and it's use of AES-EAX?

spt

Subject: I-D Action:draft-c1222-transport-over-ip-04.txt
From: [email-masked]
To: [email-masked]
Date: Fri, 9 Jul 2010 16:45:01 -0700 (PDT)
List-Id: Internet Draft Announcements only <i-d-announce.ietf.org>

A New Internet-Draft is available from the on-line Internet-Drafts directories.

	Title           : ANSI C12.22, IEEE 1703 and MC12.22 Transport Over IP
	Author(s)       : A. Moise, J. Brodkin
	Filename        : draft-c1222-transport-over-ip-04.txt
	Pages           : 23
	Date            : 2010-07-09

This RFC provides a framework for transporting ANSI C12.22/IEEE 1703/
MC12.22 Advanced Metering Infrastructure (AMI) Application-Layer
Messages on an IP network.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-c1222-transport-over-ip-04.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.
_______________________________________________
I-D-Announce mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/i-d-announce
Internet-Draft directories: http://www.ietf.org/shadow.html
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

---

From: David McGrew <[email-masked]>
Date: Fri, 23 Jul 2010 12:40:59 -0700

Hi Sean,

there was a detailed discussion about EAX' (that's pronounced "EAX  
prime") and the C12.22 encryption requirements on the [email-masked] 
  mail list May-June.  ANSI C12.22 uses EAX', which is slightly  
different from (and not interoperable with) EAX.  In an appendix of  
the ANSI standard, there is an analysis of CCM and why it is not  
sufficient and why a new AEAD method is needed.   That appendix was  
recently revised (Tom Phinney, who I've copied on this message, sent  
the revision to the NIST SG crypto mail list) in order to correct a  
wrong assumption and add the justification of why GCM is not  
sufficient.  Perhaps Tom could forward the new justification to the  
list.

I personally did not find the justification for EAX' compelling, in  
part because it seemed to me that if the protocol had adequate key  
management, then an existing mode of operation would be sufficient.   
Apparently it uses a group-key model, which imposes restrictions on  
key usage and nonces/IVs.   I suspect that there are better ways to  
solve this problem, such as using something like Encrypted Key  
Transport along with GCM or CCM, or using AES SIV for that matter.     
At any rate, it would be useful to have more review of the EAX' issues  
(and the key management used in C12.22), and people should form their  
own opinions.

David

On Jul 13, 2010, at 9:09 AM, Sean Turner wrote:

> Date: July 9, 2010 4:45:01 PM PDT
> Reply-To: [email-masked]
>
>
> <mime-attachment>_______________________________________________
> Cfrg mailing list
> [email-masked]
> http://www.irtf.org/mailman/listinfo/cfrg