Subject: Re: [Pana] pana-pana Issue235: Nonce AVP

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 05 Jan 2006 14:37:33 -0500

Received answer from Steven M. Bellovin:

---
I doubt it has to be that long, though without reading the spec I can't
be sure.  My reaction would be to leave the maximum alone, then add a
recommendation for the usual length.  If the key being generated is a
128-bit AES key, I suspect that using 16 bytes for each nonce is more
than enough.

                --Steven M. Bellovin, http://www.cs.columbia.edu/~smb
---

I think we can keep the current text, but adding a recommendation on a
specific length of nonce for each integrity protection algorithm.

I also found the following thread on nonce length:

http://www.vpnc.org/ietf-ipsec/01.ipsec/msg02496.html

For PANA, I think we can take option 1) mentioned the above thread.

In that case, 16-byte each nonce (32-byte after concatenating each
peer's nonce) is still more than enough for HMAC_SHA1 (20-byte key
length) which is the only supported integrity protection algorithm in
this version of PANA protocol.

On the other hand, nonce exchange occurs in PSR/PSA exchange before
the PaC knows the actual integrity protection algorithm (the actual
integrity protection algorithm is known to the PaC during
authentication and authorization phase via MAC AVP carried in PFER or
PBR message.)  So, we should also recommend the PaC to generate the
same length of nonce as the PAA generated, in the PSR/PSA exchange
(PAA always knows the actual integrity protection algorithm).

Does this look good?

Regards,
Yoshihiro Ohba

On Tue, Dec 27, 2005 at 12:05:36PM -0500, Yoshihiro Ohba wrote:
> >8.9  Nonce AVP
> >
> >   The Nonce AVP (AVP Code 9) carries a randomly chosen value that is
> >   used in cryptographic key computations.  The AVP data is of type
> >   OctetString and it contains a randomly generated value in opaque
> >   format.  The data length MUST be between 8 and 256 bytes inclusive.
> >  
> >
> Again, point to RFC4086 for random values. Do you really need to allow 
> for a 256 BYTE Nonce? Seems excessive, though I am not a cryptographer -
> 
> please ask someone on the security directorate (Steve, Russ, Sam, or 
> someone else) about this. I'm afraid if someone uses 256 bytes you could
> 
> run into IP-fragmented PANA messages, which while possible to be 
> processed of course, I imagine could inhibit performance on some 
> platforms (and possibly run into unexpected bugs and overruns in badly 
> written software).
> 
> _______________________________________________
> Pana mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/pana
> 
> ______________________________________________________________________
> This email has been scanned by the MessageLabs Email Security System.
> For more information please visit http://www.messagelabs.com/email 
> ______________________________________________________________________
> 

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: "Alper Yegin" <[email-masked]>
Date: Tue, 10 Jan 2006 00:15:20 +0200

Yes, this sounds reasonable to me.

Alper