Subject: [MSEC] RE:FW: new draft draft-euchner-MIKEY-DHHMAC-00.txt "HMAC-authenti cat ed Diffie-Hellman for MIKEY"

From: "Fredrik Lindholm (ERA)" <[email-masked]>
Date: Thu, 28 Feb 2002 13:30:36 +0100

Hi,

Some comments on the proposal. I had an off-line 
discussion with Martin, a few weeks ago. Some of these 
comments were raised then as well. 

The primary intention of DHHMAC is not to depend on a PKI 
(or the use of certificates). By introducing pre-shared 
keys, a PKI will of course not be needed. However, I 
personally don't see that MIKEY requires a PKI which is 
stated in DHHMAC (it is only stated that a PKI may be 
needed for scalability). There are no requirements in 
MIKEY that the public-keys must be distributed in a 
specific way. Of course, I see a few very obvious ways 
to distribute the public keys:

1) using a "full-fledge" PKI solution (with well defined 
distribution channels)

2) using self-signed certificates (which will lead to 
different requirements on the distribution)

3) ignore certificates and share the public-keys in whatever 
way you like (e.g. manually inserting the key in the user 
key database like a pre-shared key). The implication of this 
would be that the public keys would be just like pre-shared 
keys. In MIKEY, it is not specified how the user key database 
is built up (as this is viewed as implementation specific), 
e.g. if it is built only on certificates or if it may 
contain "hard coded" public keys. 

Another comment concerns the scenarios addressed. The DHHMAC 
will not work for some of these scenarios it will only work 
in a one-to-one scenario, not in small-size groups as stated. 

A comment concerning the HMAC. The HMAC in DHHMAC may be used 
with either SHA-1 or a truncated SHA-1. Using HMAC with a 
truncated hash, rather than truncated HMAC with full hash, is 
highly non-standard. In particular, what are the security 
effects of truncating the 'inner' hash in the HMAC? It seems 
that, e.g., under heuristic assumptions on the keying and the 
use of the padding strings in HMAC, the collision probability 
(hence also forgery probability), appears to increase by a 
factor of two.

So my personal opinion is that the DHHMAC will solve a problem 
that already can be solved by MIKEY. By using the HMAC instead 
of signatures will of course decrease the overall computational 
workload. However, due to the DH computations needed, I don't 
think a new method can be motivated from an efficiency point 
of view either.

Best Regards,
Fredrik

> -----Original Message-----
> From: Euchner Martin ICN M SR 3 [mailto:[email-masked]]
> Sent: den 30 januari 2002 16:57
> To: [email-masked]
> Subject: [MSEC] FW: new draft draft-euchner-MIKEY-DHHMAC-00.txt
> "HMAC-authenticat ed Diffie-Hellman for MIKEY"
> 
> 
> 
> 
> 
> -----Original Message-----
> -From: 	Euchner Martin  ICN M SR 3
> Sent:	Monday, January 28, 2002 10:36 AM
> To:	'Thomas Hardjono'; Euchner Martin  ICN M SR 3
> Subject:	new draft draft-euchner-MIKEY-DHHMAC-00.txt
> "HMAC-authenticated Diffie-Hellman for MIKEY"
> Thomas,
> 
> as indicated at the past IETF MSEC WG meeting, I see reasons 
> for a fourth
> key management protocol variant in MIKEY. Please find attached my
> corresponding Internet Draft with a proposed specification of 
> such a scheme.
> However, before submitting my ID to the IETF secretariat, I 
> would like to
> consult with you how to best handle this issue.
> Please let me hear your advice on whether to make this an 
> MSEC WG draft or
> keep it as an individual draft for the time being? Of course, 
> I appreciate
> any other feedback as well.
> 
>   <<draft-euchner-MIKEY-DHHMAC-00.txt>>
> 
> With kind regards
> 
> Martin Euchner.
> --------------------------------------------------------------
> ---------
> | Dipl.-Inf.                     Phone: +49 89 722 55790
> | Martin Euchner                 Fax  : +49 89 722 47713
> | Siemens AG
> | ICN M SR 3                     mailto:[email-masked]
> |                                mailto:[email-masked]
> | Hofmannstr. 51                 Intranet:
> http://intranet.icn.siemens.de/marketing/sr/pages/122/122_euchner.htm
> | D-81359 Muenchen               Internet: http://www.siemens.de/
> | __________________
> | Germany
> --------------------------------------------------------------
> ---------
> 
> -----Original Message-----
> -From: 	Thomas Hardjono [mailto:[email-masked]]
> Sent:	Monday, January 14, 2002 11:19 PM
> To:	Euchner Martin  ICN M SR 3
> Subject:	RE: [MSEC] Draft of minutes from IETF52 Salt Lake City
> 
> Thanks Martin.
> cheers,
> thomas
> ------
> 
> At 1/14/2002||10:43 AM, you wrote:
>  >Thomas,
>  >
>  >In your meeting report you mentioned the following statement:
>  >
>  >Another person (?) mentioned that he has a fourth key 
> establishment scheme
>  >in mind.  Will write an I-D and post to the mailing list.
>  >
>  >
>  >Actually, it was me myself who made that true statement. 
> Thus, you can
>  >frankly substitute my name there.
>  >
>  >To be honest, I had not yet time to start writing such an 
> ID as desired,
> but
>  >I hope, I will find some time and be productive until the 
> next meeting.
>  >Watch out"
>  >
>  >With kind regards
>  >
>  >Martin Euchner.
>  
> >-------------------------------------------------------------
> ----------
>  >| Dipl.-Inf.                     Phone: +49 89 722 55790
>  >| Martin Euchner                 Fax  : +49 89 722 47713
>  >| Siemens AG
>  >| ICN M SR 3                     
mailto:[email-masked]
 >|                                mailto:[email-masked]
 >| Hofmannstr. 51                 Intranet:
 >http://intranet.icn.siemens.de/marketing/sr/pages/122/122_euchner.htm
 >| D-81359 Muenchen               Internet: http://www.siemens.de/
 >| __________________
 >| Germany
 >-----------------------------------------------------------------------
 >
 >  -----Original Message-----
 >From:   Thomas Hardjono [mailto:[email-masked]]
 >Sent:   Friday, January 11, 2002 11:42 PM
 >To:     [email-masked]
 >Cc:     [email-masked]
 >Subject:        [MSEC] Draft of minutes from IETF52 Salt Lake City
 >
 >  << File: msec52_minutes-draft1.txt >>
 >Folks,
 >
 >Attached is the draft of the minutes from the MSEC WG meeting
 >at IETF52 in Salt Lake City.
 >
 >My apologies for being late.
 >
 >Please look at it and comment a.s.a.p.  This was my effort at merging
 >the two pieces of the minutes (Thanks to Dennis and Lakshminath for
 >consecutively taking the minutes).
 >
 >If there are no major objections I might try to include it with the slides
 >for submission to the formal IETF52 Proceedings (deadline Jan/14).
 >
 >All the slides are now on the website, and only this minutes-file
 >is missing/late.
 >
 >cheers,
 >
 >thomas
 >------

_______________________________________________
msec mailing list
[email-masked]
http://www.pairlist.net/mailman/listinfo/msec