Subject: [Seamoby] CTP Issue 22: Authorization Token is obtained by truncating the results of the HMAC_SHA1 computation to retain only the leading 32 bits

From: "James Kempf" <[email-masked]>
Date: Tue, 16 Sep 2003 10:40:45 -0700

Issue 22 suggests that 32 bits isn't enough for the authorization token.

See http://danforsberg.info:8080/draft-ietf-seamoby-ctp/issue22 for details.

Possible resolutions:

1) Make the authorization token longer, say 64 bits.
2) Keep the authorization token at 32 bits.

Suggested resolution: Make the authorization token longer, say 64 bits.
Justification: The probability of a birthday attack is proportional to
2**(sqrt(n)), where n is the number of bits in the identifier. If n is 32,
then sqrt(n) is 16, which is not enough protection (65536). Making n equal
64 means sqrt(n) is 32 (over 4 billion) which should be enough.

_______________________________________________
Seamoby mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/seamoby

---

From: Charlie Perkins <[email-masked]>
Date: Tue, 16 Sep 2003 12:34:17 -0700

Hello James,

I don't think it is needed, for two reasons:

- The authorization token is only going to be used once

- The data being protected is only good for a few hundred
   milliseconds at most (typically).

Regards,
Charlie P.

---

From: "James Kempf" <[email-masked]>
Date: Tue, 16 Sep 2003 12:58:53 -0700

Hi Charlie,

These are good arguments, but I don't see them swaying the security
directorate. Assuming one instruction per cycle and perhaps 100 instructions
to check, a 2 GHz Pentium can check about 20 million tokens per second.
Assuming 200 ms active time, that's about 4 million tokens in the time that
the token is active.

One can argue with the details of the above calculation, but it is the kind
of thing I'd expect to see pop out of a security review. Of course, I
suppose we could argue that the document is Experimental anyway, so perfect
security isn't necessary, but what's the harm in lengthening the field?

            jak

----- Original Message ----- 
From: "Charlie Perkins" <[email-masked]>
To: "James Kempf" <[email-masked]>
Cc: <[email-masked]>
Sent: Tuesday, September 16, 2003 12:34 PM
Subject: Re: [Seamoby] CTP Issue 22: Authorization Token is obtained by
truncating the results of the HMAC_SHA1 computation to retain only the
leading 32 bits

---

From: Charlie Perkins <[email-masked]>
Date: Tue, 16 Sep 2003 13:15:34 -0700

Hello Jim,

Maybe it's time to insert rationality back into security protocol design.
I'm willing to stand the heat.  Mainly I am concerned about data fields
that have to be passed over the air.  Conservatism is indicated for this
reason, and the reward is less hogging the airwaves.

I am not worried about silicon, but in fact it would be nice if we
did try to avoid mandating every protocol to require a Pentium
processor.

Regards,
Charlie P.

James Kempf wrote:

>>>See http://danforsberg.info:8080/draft-ietf-seamoby-ctp/issue22 for
>>>      
>>>
>details.
>  
>
>>>Possible resolutions:
>>>
>>>2**(sqrt(n)), where n is the number of bits in the identifier. If n is
>>>      
>>>
>32,
>  
>
>>>then sqrt(n) is 16, which is not enough protection (65536). Making n
>>>      
>>>
>equal
>  
>

---

From: "James Kempf" <[email-masked]>
Date: Tue, 16 Sep 2003 13:26:34 -0700

> I'm willing to stand the heat.

Does that mean that you're willing to take over as WG chair? :-)

>Mainly I am concerned about data fields

Sure.

> did try to avoid mandating every protocol to require a Pentium

Well, ok, we can leave it at 32 bits, but if we get this thrown back into
our face by the IESG, I'm going to say "I told you so!"

            jak