Subject: [lamps] draft-housley-lamps-cms-aes-mac-alg-00 Section 7

From: "Brockhaus, Hendrik" <[email-masked]>
Date: Mon, 23 Nov 2020 17:36:43 +0000

Hi Russ

As in AES-GMAC the uniqueness of the nonce is crucial,  I want to propose to add the following text in Section 7 right before the last paragraph.
"Implementations must generate nonce values which must be unique for a given message-authentication key. Repeating a nonce value only once allows an attacker to generate valid AES-GMAC authentication codes for arbitrary messages, which results in no security of the authentication code (see [GCM], Appendix A)."

May be it is also of value to add this in Section 5 of draft-housley-lamps-crmf-update-algs as well.

Hendrik

Hendrik Brockhaus
Siemens AG
T RDA CST SEA-DE
mailto:[email-masked]

www.siemens.com

Siemens Aktiengesellschaft: Chairman of the Supervisory Board: Jim Hagemann Snabe; Managing Board: Joe Kaeser, Chairman, President and Chief Executive Officer; Roland Busch, Klaus Helmrich, Cedrik Neike, Matthias Rebellius, Ralf P. Thomas, Judith Wiese; Registered offices: Berlin and Munich, Germany; Commercial registries: Berlin-Charlottenburg, HRB 12300, Munich, HRB 6684; WEEE-Reg.-No. DE 23691322

---

From: Russ Housley <[email-masked]>
Date: Mon, 23 Nov 2020 13:02:15 -0500

Section 3.1 says: Within the scope of any content-authentication key, the nonce value MUST be unique.

I agree that the Security Considerations should also talk about the consequences of reusing a nonce value.

Russ

> On Nov 23, 2020, at 12:36 PM, Brockhaus, Hendrik <[email-masked]> wrote:
> 
> Hi Russ
>

---

From: "Brockhaus, Hendrik" <[email-masked]>
Date: Tue, 24 Nov 2020 07:12:29 +0000

The goal was to make the consequences more explicit.
Hendrik

> Von: Russ Housley <[email-masked]>
> Gesendet: Montag, 23. November 2020 19:02
> 
> > As in AES-GMAC the uniqueness of the nonce is crucial,  I want to propose
> to add the following text in Section 7 right before the last paragraph.
> > "Implementations must generate nonce values which must be unique for a
> given message-authentication key. Repeating a nonce value only once allows
> an attacker to generate valid AES-GMAC authentication codes for arbitrary
> messages, which results in no security of the authentication code (see [GCM],
> Appendix A)."
> >
> > http://www.siemens.com/
> > Siemens Aktiengesellschaft: Chairman of the Supervisory Board: Jim
> Hagemann Snabe; Managing Board: Joe Kaeser, Chairman, President and Chief
> Executive Officer; Roland Busch, Klaus Helmrich, Cedrik Neike, Matthias
> Rebellius, Ralf P. Thomas, Judith Wiese; Registered offices: Berlin and Munich,
> Germany; Commercial registries: Berlin-Charlottenburg, HRB 12300, Munich,
> HRB 6684; WEEE-Reg.-No. DE 23691322