Subject: Re: [MSEC] draft-ietf-msec-srtp-tesla-00.txt

From: "Dondeti, Lakshminath" <[email-masked]>
Date: Fri, 23 Apr 2004 13:26:40 -0400

Hi Mark/Elisabetta,

I have a couple of questions on the SRTP-TESLA I-D:

1. In Figure 1, and the associated text:

Isn't Id optional?  Also, is it a variable length payload, or do you 
plan to suggest a key chain length?

2.  Figure 2 indicates that the disclosed TESLA key is in the clear.

Is that intended?  I thought about it a little bit: it might not be 
directly useful for an attacker as that key is not going to be used to 
authenticate any future/current traffic, but why disclose a key from the 
key chain if it can be avoided.  Any thoughts on this.

Nit:  Please replace MAC with ICV or auth tag or something like that.

thanks,
Lakshminath

Mark Baugher wrote:

> Dear Internet Drafts Editor:
> Please post the version 0 draft of the following draft
> http://www.rdrop.com/users/mbaugher/I-D/draft-ietf-msec-srtp-tesla-00.txt
>
> This is an official msec working group I-D.  Please notify 
> [email-masked].
>
> thanks, Mark
>
>
> _______________________________________________
> msec mailing list
> [email-masked]
> http://www.pairlist.net/mailman/listinfo/msec
>

_______________________________________________
msec mailing list
[email-masked]
http://www.pairlist.net/mailman/listinfo/msec

---

From: Mark Baugher <[email-masked]>
Date: Fri, 23 Apr 2004 11:08:06 -0700

Hello Lakshminath,

At 10:26 AM 4/23/2004, Dondeti, Lakshminath wrote:
>Isn't Id optional?  Also, is it a variable length payload, or do you plan 
>to suggest a key chain length?

I did not think that would be wise since section 6.2 of 
http://www.ietf.org/internet-drafts/draft-ietf-msec-srtp-tesla-00.txt and 
the length is fixed according to 6.2.

>2.  Figure 2 indicates that the disclosed TESLA key is in the clear.

The only key I see in Figure 2 is "Disclosed Key" - and yes this is 
disclosed to prove the authenticity of the previous message (see section 6.2).

>key chain if it can be avoided.  Any thoughts on this.

That's how I understand this thing to work, Lakshminath, from
http://www.ece.cmu.edu/~adrian/projects/tesla-cryptobytes/tesla-cryptobytes.pdf 
on page 2:
"
The main idea of TESLA is that the sender attaches
to each packet a MAC computed with a key k known
only to itself. The receiver buffers the received packet
without being able to authenticate it. A short while
later, the sender discloses k and the receiver is able to
authenticate the packet. Consequently, a single MAC
per packet suffices to provide broadcast authentication,
provided that the receiver has synchronized its
clock with the sender ahead of time.
[pg. 2]."

That "k" is our K_i.

>Nit:  Please replace MAC with ICV or auth tag or something like that.

I don't understand since this field is a message authentication code.

thanks, Mark

---

From: "Dondeti, Lakshminath" <[email-masked]>
Date: Fri, 23 Apr 2004 15:06:19 -0400

Ok, my mistake.  I did not read section 6.2 :-(

On disclosing the key, I meant disclosing to eavesdroppers (as in your 
spec) vs. disclosing to the receivers.  Sorry for the confusion.

regards,
Lakshminath

Mark Baugher wrote:

> http://www.ietf.org/internet-drafts/draft-ietf-msec-srtp-tesla-00.txt 
> and the length is fixed according to 6.2.
>
>
>> directly useful for an attacker as that key is not going to be used 
>> to authenticate any future/current traffic, but why disclose a key 
>> from the key chain if it can be avoided.  Any thoughts on this.
>
>
> <http://www.ece.cmu.edu/%7Eadrian/projects/tesla-cryptobytes/tesla-cryptobytes.pdf> 
> on page 2:
> "

---

From: Mark Baugher <[email-masked]>
Date: Fri, 23 Apr 2004 12:16:40 -0700

>the length is fixed according to 6.2.

Sorry, I meant to type that section 6.2 uses the Id in the form of K_i.  So 
we don't make it optional in srtp-tesla even though the Tesla MSEC I-Ds of 
Cannetti, Perrig, et. al. allow it.

ciao, Mark