Subject: Re: HMAC stuff, summary, suggestions, etc ...

From: Antoni Przygienda <[email-masked]>
Date: Tue, 29 Sep 1998 16:27:01 -0400

> 2) As for key rollover, in the original "authentication" in IS-IS
>    (basically copied from OSPF, but slightly improved), ...
>
>    If you wanted to do something like that there
>    might be tens of secrets, in which case computing tens of HMACs to
> find
>    out if the packet matched any of them would
>    be expensive. Worse yet, the worst case is for illegal packets,
> since then
>    you have to try ALL keys (whereas in the expected case of a real
> packet,
>    you could get by with trying half on average).
>
>    The alternative is to have a "key ID", and have as part of the HMAC
> option
>    field the key ID followed by the HMAC. The cost of putting this in
> is
>    perhaps 1 byte in the message and extra configuration (a key ID in
>    addition to the secret itself). Though maybe you could do something
>
>    clever like do a hash of the secret to compute a key ID, and only
> in
>    the case where the hash had collisions (since it would only be,
> say, a
>    1 or 2 byte hash so as to save room in packets)
>    would you have to try multiple
>    keys. If key ID=hash, then there is no additional configuration
> necessary,
>    and the only cost is room in the packet. So I'd recommend that.
>
>    Even if the only thing we care about is key rollover, it seems
> worth
>    the cost to have a "key ID" field to save the work of testing
>    multiple keys.

to pick up this one again, I personally think that inserting 2 bytes key
ID into the packet format would be sensible since it makes the roll-over
& supporting sets of keys simpler. If we don't want to force people to
do it we can just say that 0 value is reserved & means no key id
specified and specifying key id is optional in general. However, we'd
need to specify the hash function ...

Any takers ?

        thank you

        --- tony