Subject: RE: [MSEC] WG Last Call for RSA-signatures draft (closingdateFriday20August 2004)

From: <[email-masked]>
Date: Tue, 10 Aug 2004 14:39:40 -0400

comments inline.

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of ext Dondeti,
> Lakshminath
> Sent: Tuesday, August 10, 2004 1:24 PM
> To: Sharma Atul (Nokia-ES/Boston)
> Cc: [email-masked]; [email-masked]; [email-masked]
> Subject: Re: [MSEC] WG Last Call for RSA-signatures draft
> (closingdateFriday20August 2004)
> 
> 
> Clarification: per-packet overhead in some hash chaining 
> schemes, e.g., 
> EMSS is about the same as (e.g., 6-degree hash chain would amount to 
> 120B of overhead) RSA-sig.  I don't know the overhead of your recall 
> packet scheme.

There is only one HMAC field in Recall Packet scheme, the size of which of 
course depends on the algorithm chosen. There is no per-packet overhead with 
scalability issues in this scheme in its vanilla form.

> Please clarify this: do you mean that it is ok in some cases 
> to accept 
> unverifiable packets as legitimate?  Apologies if that's not 
> what you meant.

Let me reiterate in a different way: a packet loss in Hash chaining
has different implications; a packet loss in Recall Packet has different
implications. It will be tough to argue that one implication/symptom
is more acceptable than the other.

> regards,
> Lakshminath
> 
> [email-masked] wrote:
 > 
> >Lakshminath,
> >
> >You are not correct in stating that per packet ovehead of 
> Recall Packet
> >Scheme will be that of RSA-Sig scheme. May be you are 
> confusing that with
> >Delegated Authentication, the other scheme I presented, 
> where the per-packet
> >overhead can approach that of RSA-Sig scheme. Recall packet 
> scheme does not
> >incur such overheads.
> >
> >You are right though, a loss of Recall packet in Recall 
> Packet scheme would
> >mean an illegitimate packet being accepted. Basically packet 
> loss will be
> >manifested as a different symptom for different schemes. It 
> will be tough
> >to argue which symptom is acceptable and which symptom is not.
> >
> >BR,
> >Atul
> >
 
_______________________________________________
msec mailing list
[email-masked]
http://six.pairlist.net/mailman/listinfo/msec

---

From: "Dondeti, Lakshminath" <[email-masked]>
Date: Tue, 10 Aug 2004 15:05:34 -0400

In your scheme, an adversary can introduce bogus packets, and can make 
the receivers believe there is nothing wrong.  In hash chaining or 
TESLA, receivers drop packets that they cannot verify, i.e., the 
adversary can create packet losses and launch at best a DoS attack.  
Successful packet modification attacks are worse than DoS attacks.

regards,
Lakshminath