Subject: New Encrypted Data Packet?

From: Jon Callas <[email-masked]>
Date: Mon, 4 Apr 2005 08:27:32 -0700

When the Mister-Zuccherato attack came out at the beginning of the 
year, one of the suggestions that we had was to re-do the encrypted 
data packet and MDC. It seems that there's not really a lot of 
consensus to fix it, that merely working around the problem seems to be 
adequate? Am I right in that perception? Do we want to upgrade it?

I still think it's a good idea, myself, particularly since if you want 
wide deployment of such a thing for the future getting on it now is a 
good idea. But I would also like to really close out 2440bis, too. 
(However, the two are not mutually exclusive. We could close out 
2440bis and put the upgrades into a followon RFC.)

	Jon

---

From: Edwin Woudt <[email-masked]>
Date: Mon, 04 Apr 2005 18:09:02 +0200

--On 4-4-2005 8:27 -0700 Jon Callas <[email-masked]> wrote:
>
> When the Mister-Zuccherato attack came out at the beginning of the year,
> one of the suggestions that we had was to re-do the encrypted data packet
> and MDC. It seems that there's not really a lot of consensus to fix it,
> that merely working around the problem seems to be adequate? Am I right
> in that perception? Do we want to upgrade it?
>
> (However, the two are not mutually exclusive. We could close out 2440bis
> and put the upgrades into a followon RFC.)

I agree it is a good idea, but not for 2440bis. As there is a workaround, I 
would say: add a note about the attack and the workaround to 2440bis and 
get it finished.

Redoing the encrypted data packet can then be implemented together with v5 
keys and any other hash related changes. This also solves the problem of 
deciding which implementations support such a new encrypted data packet: 
just use the new packet for v5 keys, and the old ones for v4 and below.

-- 
Edwin

---

From: Ian G <[email-masked]>
Date: Mon, 04 Apr 2005 17:37:11 +0100

Jon Callas wrote:
> one of the suggestions that we had was to re-do the encrypted data 
> packet and MDC. It seems that there's not really a lot of consensus to 
> fix it, that merely working around the problem seems to be adequate? Am 
> I right in that perception? Do we want to upgrade it?
> 

Close out 2440bis, with no more changes.  I think we are well
past the point where fiddling around improving things is worth
anything.  Unless we have a major major break, nothing should
change in the protocol, would be my call.

(Which would not be to say that Ben's observations over the
weekend didn't look extremely useful.)

(As to future revisions, I recall in prior times it has been
discussed that we wouldn't talk about future changes until
2440bis was closed out.)

iang
-- 
News and views on what matters in finance+crypto:
         http://financialcryptography.com/

---

From: Jon Callas <[email-masked]>
Date: Mon, 4 Apr 2005 13:27:37 -0700

> weekend didn't look extremely useful.)

I'm going to look through Ben's suggestions and fold them into a new 
draft.

> discussed that we wouldn't talk about future changes until

Yeah, but security-related cryptographic changes are always the obvious 
exception.

	Jon

---

From: Ben Laurie <[email-masked]>
Date: Tue, 05 Apr 2005 13:04:55 +0100

> I right in that perception? Do we want to upgrade it?

I missed this discussion, I think, and can't seem to find it in the 
archives. Do you have a refrence?

> and put the upgrades into a followon RFC.)

That sounds like a plan.

-- 
http://www.apache-ssl.org/ben.html       http://www.thebunker.net/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff