Subject: Re: [OPSAWG] Call for Adoption: draft-hmac-sha-2-usm-snmp

From: Johannes Merkle <[email-masked]>
Date: Mon, 1 Sep 2014 14:19:07 +0200

As Warren asked us to check the option of combining both drafts, I'm not sure if a general vote for one draft is the
best way forward.

I would appreciate if all interested parties (incl Tom and David) could indicate their preference in the following 3
questions:

1. Should the protocols be described
a) as "diff" to the previous protocols like done in draft-hmac-sha-2-usm-snmp, or
b) completely and based on a decription of a generic hmac-based authentication protocol, as done in draft-hartman?

2. Should the protocols be based on complete or truncated HMACs?

3. Which (sub)set of protocols (hash function, MAC length) should be selected?

Johannes

David Reid wrote on 29.08.2014 15:36:
>> I would like to see draft-hmac proceed, pretty much as is.
> 
> +1
> 
> -David Reid
> 
>

---

From: David Reid <[email-masked]>
Date: Tue, 02 Sep 2014 10:26:05 -0400

> As Warren asked us to check the option of combining both drafts, 
> I'm not sure if a general vote for one draft is the best way forward.
> 
> I would appreciate if all interested parties (incl Tom and David) 
> could indicate their preference in the following 3 questions:
> 
> a) as "diff" to the previous protocols like done in draft-hmac, or
> b) completely and based on a decription of a generic hmac-based 
>    authentication protocol, as done in draft-hartman?

a. as "diff" 

> 2. Should the protocols be based on complete or truncated HMACs?

truncated

> 3. Which (sub)set of protocols (hash function, MAC length) should be selected?

usmHMAC192SHA256AuthProtocol and usmHMAC384SHA512AuthProtocol.

I don't have a strong opinion on this, I only pick these 2 based on
comments from Wes and Uri who both understand security better than I do.

   Wes> I'm not entirely convinced that a 256bit truncation is better than a
   Wes> 384 bit truncation, so my preference would be to include just two
   Wes> algorithms because I don't think they're all needed and will just make
   Wes> things more confusing.  So I'd pick the best two of the 6 and go with
   Wes> them, for which my preference would be:
   Wes> 1)  MUST: usmHMAC192SHA256AuthProtocol
   Wes>   SHOULD: usmHMAC384SHA512AuthProtocol
   Wes> 2)  MUST: usmHMAC192SHA256AuthProtocol
   Wes>   SHOULD: usmHMAC256SHA512AuthProtocol

   Uri> Can we have mandatory-to-implement in an "optional" RFC? Assuming the
   Uri> answer is yes, I'd recommend:
   Uri> For those who implement this RFC, usmHMAC192SHA256AuthProtocol is MUST,
   Uri> usmHMAC384SHA512AuthProtocol is SHOULD, everything else is MAY.

-David Reid

---

From: Warren Kumari <[email-masked]>
Date: Tue, 2 Sep 2014 11:27:11 -0400

> As Warren asked us to check the option of combining both drafts, I'm not sure if a general vote for one draft is the

Sure, fair 'nuff.

> 3. Which (sub)set of protocols (hash function, MAC length) should be selected?

These sound like reasonable questions to me -- lets give this a few
days to see where things settle (hint: if you have views on this
topic, please reply so your views are heard).

W

-- 
I don't think the execution is relevant when it was obviously a bad
idea in the first place.
This is like putting rabid weasels in your pants, and later expressing
regret at having chosen those particular rabid weasels and that pair
of pants.
   ---maf

---

From: Johannes Merkle <[email-masked]>
Date: Thu, 4 Sep 2014 12:22:29 +0200

> topic, please reply so your views are heard).

Actually, I'll have to give it two weeks as I will be on holiday.

-- 
Johannes

---

From: t.petch <[email-masked]>
Date: Wed, 17 Sep 2014 15:08:19 +0100

----- Original Message -----
From: "Johannes Merkle" <[email-masked]>
To: <[email-masked]>
Cc: "David Reid" <[email-masked]>; "t.petch" <[email-masked]>;
"Warren Kumari" <[email-masked]>; "[email-masked]" <[email-masked]>
Sent: Monday, September 01, 2014 1:19 PM
> As Warren asked us to check the option of combining both drafts, I'm
not sure if a general vote for one draft is the
> I would appreciate if all interested parties (incl Tom and David)
could indicate their preference in the following 3
> a) as "diff" to the previous protocols like done in
draft-hmac-sha-2-usm-snmp, or

as a 'diff', because it is easier to get right (you have to know the
base to start with so a 'complete' you keep on having to look back and
to try and spot the changes.

> 2. Should the protocols be based on complete or truncated HMACs?

truncated (but I do not have the security credentials to back that up
mathematically)

> 3. Which (sub)set of protocols (hash function, MAC length) should be
selected?

I remain content with the results of our discussion earlier in the
year - I know of nothing since to require a change

Tom Petch

---

From: Johannes Merkle <[email-masked]>
Date: Tue, 23 Sep 2014 10:33:02 +0200

Uri Blumenthal asked me to forward his answers below to the list (he is not subscribed).

Johannes

-------- Original Message --------
Betreff: Re: [OPSAWG] Call for Adoption: draft-hmac-sha-2-usm-snmp
Datum: Mon, 22 Sep 2014 17:19:38 +0000
Von: Blumenthal, Uri - 0558 - MITLL <[email-masked]>
An: Johannes Merkle <[email-masked]>

Please feel free to forward my answers (below) to the list.

>As Warren asked us to check the option of combining both drafts, I'm not
>sure if a general vote for one draft is the
>best way forward.
>
>I would appreciate if all interested parties (incl Tom and David) could
>indicate their preference in the following 3
>questions:
>

Considering that these protocols comprise an addition to USM, and
follow/complement the existing USM approach, it seems reasonable to
describe them in a form that you (imprecisely, IMHO) characterize as
“diff”. This saves time and space without economizining on clarity.

>2. Should the protocols be based on complete or truncated HMACs?

Not crucially important, given the size of resulting mac’s, but it seems
to make sense to save some real estate on the wire, and to make
verification of a lucky guess a bit harder.

I am for HMAC truncation.

>3. Which (sub)set of protocols (hash function, MAC length) should be

There probably is no doubt that protocols based on SHA-256 and SHA-384
need to be there. SHA-512 might cause some raised brows, as could SHA-224.
I still would add them - SHA-512 as SHOULD, and SHA-224 as MAY.

How much to truncate - is a good question. For SHA-512 I’d say it’s
perfectly OK to truncate half of its output and still be in a good and
safe place (who can now envision the need of a 512-bit MAC?). For SHA-256
and SHA-384 I’d consider truncating 64 bits of its output, but would like
to hear suggestions (justified) to cut more or less.