Subject: [core] Missing must in the Group OSCORE document

From: Jim Schaad <[email-masked]>
Date: Sat, 1 Aug 2020 12:25:25 -0700

Christian,

 I have been thinking about the problem case of having a duplicate IV reuse
in the case where I suggested that we use separate IV spaces for the group
and pairwise keying materials.  I agree that this is a problem, however the
problem is greater than what you outlined.  This is going to be a situation
that will arise anytime that the request comes in under one security context
and the response goes out under a different security context.  In this
situation you will always have the problem that a reflected IV value from
context 1 will lead to a potential IV reuse in context 2.

Missing requirement in the document:

A server MUST use a PIV value from it's own sender context when ever it
would normally use a reflected IV, but the security context for the request
and response are not the same.

Jim

---

From: Marco Tiloca <[email-masked]>
Date: Tue, 4 Aug 2020 10:08:44 +0200

Hi Jim,

> and response are not the same.

==>MT
I guess here "different security context" means "different protection
mode" - hence different PIV space - regardless a possible group rekeying
happening. Correct?

This seems to confirm the issue (1) raised in slide 9 of [1]. So this
MUST-requirement would be needed if the two different PIV spaces are
introduced.

Just to clarify, do you think that the requirement is needed also in the
current document with only one PIV space?

Thanks,
/Marco

[1]
https://www.ietf.org/proceedings/108/slides/slides-108-core-sessa-group-oscore-00
<==

-- 
Marco Tiloca
Ph.D., Senior Researcher

RISE Research Institutes of Sweden
Division ICT
Isafjordsgatan 22 / Kistagången 16
SE-164 40 Kista (Sweden)

Phone: +46 (0)70 60 46 501
https://www.ri.se

---

From: Jim Schaad <[email-masked]>
Date: Tue, 4 Aug 2020 06:13:04 -0700

-----Original Message-----
From: Marco Tiloca <[email-masked]> 
Sent: Tuesday, August 4, 2020 1:09 AM
To: Jim Schaad <[email-masked]>; 'Christian Amsüss' <[email-masked]>; 'Francesca Palombini' <[email-masked]>
Cc: [email-masked]
Subject: Re: Missing must in the Group OSCORE document

Hi Jim,

On 2020-08-01 21:25, Jim Schaad wrote:
> Christian,
>
>  I have been thinking about the problem case of having a duplicate IV 
> reuse in the case where I suggested that we use separate IV spaces for 
> the group and pairwise keying materials.  I agree that this is a 
> problem, however the problem is greater than what you outlined.  This 
> is going to be a situation that will arise anytime that the request 
> comes in under one security context and the response goes out under a 
> different security context.  In this situation you will always have 
> the problem that a reflected IV value from context 1 will lead to a potential IV reuse in context 2.
>
> A server MUST use a PIV value from it's own sender context when ever 
> it would normally use a reflected IV, but the security context for the 
> request and response are not the same.

==>MT
I guess here "different security context" means "different protection mode" - hence different PIV space - regardless a possible group rekeying happening. Correct?

This seems to confirm the issue (1) raised in slide 9 of [1]. So this MUST-requirement would be needed if the two different PIV spaces are introduced.

Just to clarify, do you think that the requirement is needed also in the current document with only one PIV space?

[JLS] Yes this is needed in the current document even with only one PIV space because doing a rekey between the request and the response has this problem.
Jim

Thanks,
/Marco

[1]

--
Marco Tiloca
Ph.D., Senior Researcher