Subject: Last Call COMMENT: 'Encryption and Checksum Specifications for Kerberos 5' GENERAL

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Wed, 10 Sep 2003 00:28:13 -0700

Currently the Encrypt()/Decrypt() sequence in this draft can leave a
number of extra bytes, non-deterministic to the receiver, at the end of
the decrypted plaintext data, this can make it hard to locate trailing
headers if they exist. 

To work around this applications need either to encode a length field up
front (thus possibly destroy data alignment properties), or use other
mechanisms to recover the data length, which can have their own
limitations.  This is more evident in the GSSAPI work that we have been
working on recently where data alignments are important for the
per-message protection purposes.

We would like to propose a set of constraints to be added for the
encryption algorithms: given the size of any plaintext data, there
should always exist the next size (possibly larger), when padding the
to-be-encrypted plaintext data to that size, there will be no extra
bytes added to the result of the decryption, and the number of bytes
needed to pad the message to the next size should not exceed 32k (or
64k).

It should be noted that all existing enctypes satisfy the above
constraints nicely.  

We do recognize, however, that it can be computationally expensive to
find the next size, or there might be no such solution for new
encryptions, if not designed "properly", that use schema such as Huffman
encoding to compress the plaintext data before encryption, in that the
size of padding needed by the underlying block cipher can depend on the
value of the padding bytes.  We believe the future designers can satisfy
the constraints by adding more bookkeeping information, such as the use
of the RFC1964 padding, to eliminate the extra trailing bytes, and they
can do so by leveraging low level crypto-system details to improve
efficiency. 

Larry

-----Original Message-----
From: The IESG [mailto:[email-masked]] 
Sent: Monday, September 08, 2003 8:27 AM
Cc: [email-masked]
Subject: Last Call: 'Encryption and Checksum Specifications for Kerberos
5' to Proposed

Standard 
Reply-To: [email-masked]
Message-Id: <[email-masked]>
Date: Mon, 08 Sep 2003 10:59:59 -0400
Sender: [email-masked]
Precedence: bulk

The IESG has received a request from the Kerberos WG WG to consider the
following document:

- 'Encryption and Checksum Specifications for Kerberos 5'
   <draft-ietf-krb-wg-crypto-05.txt> as a Proposed Standard

The IESG plans to make a decision in the next few weeks, and solicits
final comments on this action.  Please send any comments to the
[email-masked] or [email-masked] mailing lists by 2003-09-22.

The file can be obtained via
http://www.ietf.org/internet-drafts/draft-ietf-krb-wg-crypto-05.txt