Subject: Re: [lamps] draft-ietf-lamps-cms-aes-gmac-alg-04.txt - profibiting useing AES-GMAC with PBKDF2

From: Russ Housley <[email-masked]>
Date: Fri, 2 Apr 2021 09:13:28 -0400

I did not see anyone raise concerns, so I am going to post a revised I-D now.

Russ

> On Mar 26, 2021, at 4:55 PM, Roman Danyliw <[email-masked]> wrote:
> 
> If anyone objects to this clarification please voice your concerns by March 30.
> 
> Roman
> 
>> -----Original Message-----
>> From: Spasm <[email-masked]> On Behalf Of Brockhaus, Hendrik
>> Sent: Wednesday, March 24, 2021 12:10 PM
>> To: Russ Housley <[email-masked]>
>> Cc: [email-masked]; [email-masked]
>> Subject: Re: [lamps] draft-ietf-lamps-cms-aes-gmac-alg-04.txt - profibiting
>> useing AES-GMAC with PBKDF2
>> 
>> Thanks, looks good.
>> 
>> Hendrik
>> 
>>> Von: Russ Housley <[email-masked]>
>>> 
>>> Thanks for this addition.  I suggest a separate paragraph as follows:
>>> 
>>>   If AES-GMAC is used as a building block in another algorithm (e.g.,
>>>   as a pseudo-random function), AES-GMAC MUST be used only one time by
>>>   that algorithm.  For instance, AES-GMAC MUST NOT be used as the
>>>   pseudo-random function for PBKDF2.
>>> 
>>> Since the IESG has already approved this document, I will reach out to
>>> Roman about how to include this.
>>> 
>>> Russ
>>> 
>>>> On Mar 24, 2021, at 9:29 AM, Brockhaus, Hendrik
>>> <[email-masked]> wrote:
>>>> 
>>>> Russ
>>>> 
>>>> While discussing some topics on CMP Algorithm, Hans explained that
>>>> AES-
>>> GMAC must not be used as prf for PBKDF2.
>>>> We suggest to extend the Security Considerations in
>>>> draft-ietf-lamps-cms-aes-
>>> gmac-alg as follows:
>>>> 
>>>> Old text:
>>>>  Within the scope of any content-authentication key, the AES-GMAC
>>>>  nonce value MUST be unique.  Use of a nonce value more than once
>>>>  allows an attacker to generate valid AES-GMAC authentication codes
>>>>  for arbitrary messages, resulting in the loss of authentication as
>>>>  described in Appendix A of [GCM].
>>>> 
>>>> New text:
>>>>  Within the scope of any content-authentication key, the AES-GMAC
>>>>  nonce value MUST be unique.  Use of a nonce value more than once
>>>>  allows an attacker to generate valid AES-GMAC authentication codes
>>>>  for arbitrary messages, resulting in the loss of authentication as
>>>>  described in Appendix A of [GCM]. If AES-GMAC is used as a  building
>>>>  block in another algorithm (e.g. as a pseudo-random function), one
>>>>  must make sure that AES-GMAC is used only once in this algorithm.
>>>>  For instance, AES-GMAC MUST NOT be used as the pseudo-random
>>>>  function for PBKDF2.
>>>> 
>>>> Hendrik
>>>> 
>>>> _______________________________________________
>>>> Spasm mailing list
>>>> [email-masked]
>>>> 
>>> https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.
>>> ietf
>>> 
>> .org%2Fmailman%2Flistinfo%2Fspasm&amp;data=04%7C01%7Chendrik.brockh
>> a
>>> 
>> us%40siemens.com%7C3b3c713edbe74819e91c08d8eed3ea73%7C38ae3bcd9
>> 5
>>> 
>> 794fd4addab42e1495d55a%7C1%7C0%7C637521941224431220%7CUnknow
>> n%
>>> 
>> 7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiL
>>> 
>> CJXVCI6Mn0%3D%7C1000&amp;sdata=%2BYA4kn0dTl%2FXupb97Hk%2FXaSm
>> 6
>>> wl0Ckw1YND%2FgRbue38%3D&amp;reserved=0
>> 
>> _______________________________________________
>> Spasm mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/spasm