Subject: crypto, aes drafts submitted

From: Ken Raeburn <[email-masked]>
Date: Mon, 24 Feb 2003 14:44:07 -0500

It may take a little while to get through the queue, so copies are
available at:

http://www.mit.edu/~raeburn/draft-ietf-krb-wg-crypto-03.txt
http://www.mit.edu/~raeburn/draft-raeburn-krb-rijndael-krb-03.txt

Main changes in the crypto draft:

    Reorganized encryption/checksum system specifications to put
    related encryption and checksum types together, instead of
    separating des3 encryption and sha1-des3 checksum.  This fixes
    some complaints Jeff Hutzelman raised about relationships between
    des3 and sha1-des3 not being made sufficiently clear.

    Allow unkeyed checksum algorithms to be used in conjunction with
    any encryption type, with appropriate warnings.

    Eliminated "null" encryption system specification, and deleted
    listing from the enctype table.

    Merged enctype tables.  Deleted "minimum pad size" column from the
    encryption summary table, since it doesn't relate to anything in
    the text, and was wrong in the only non-zero entry.  Deleted the
    block size and confounder size fields as well, since they're all 8
    for every enctype defined in this document.

    Changed checksum table so "section" column is now "section or
    reference".  Added sha1 again at number 10, with "??" in the
    reference column for now.

    Added PRF, as mentioned in Atlanta and on the list.

    Consistently describe and use E(key,msg,ivec) as a three-argument
    function in the simplified profile.

    Elaborate on weak-key issue in Security Considerations.

    Clarify message block size versus cipher block size distinction.

    Added weak-key checks to DES random-to-key, for consistency with
    DES string-to-key.  Define random-to-key in functional style right
    after string-to-key.

    Dropped prohibition against DES keys that are weak after XOR with
    F0F0... since AFAIK no one actually implements that, and it's
    pointless for security.  Remove mention of not using weak keys
    from des-mac-k spec, since we just shouldn't generate them.  (This
    means we *can* encrypt with weak keys, we just avoid generating
    them in *most* cases.)

    Note encryption type and checksum type 0 are invalid, and negative
    are reserved for local use.

    Specify padding for des-mac and des-mac-k checksum calculations.

    In des-mac-k spec, don't permit outside specification of IV.

    Tweak abstract: We *do* list some types as deprecated, just no
    *requirements* for Kerberos compliance in here.

    Added RFC Editor notes.

Main changes to AES draft:

    Describe encryption of data of one block or less.

    Fix default string-to-key parameters in table to agree with text.

    Remove Recommendations section; the Kerberos RFC will cover
    recommendations and requirements.

    Delete confounder size, since it's gone from the simplified
    profile in crypto-03.

    Change checksum numbers, since Assar says 10 is in use.

    Add Security Consideration about denial of service caused by very
    high spoofed iteration count.

Both documents now have RFC Editor notes pointing out needed updates
for reference info for I-Ds that should progress to RFC at the same
time.

Send comments to me or this list.

Ken

---

From: Ken Raeburn <[email-masked]>
Date: Mon, 24 Feb 2003 15:24:55 -0500

Oh yes -- I haven't done anything about the issue of weak-key checks
for triple-DES key generation.  I haven't gotten any feedback yet on
my email from the 17th.