Subject: Re: [core] CoRE WG Virtual Interim 2021-04-28

From: Rikard Höglund <[email-masked]>
Date: Wed, 5 May 2021 07:30:41 +0000

Hello.

Thank you John for initiating this discussion.

As mentioned during the last interim meeting, we can start expanding the current draft at [1] to also include information about an updated process for rekeying OSCORE.

Currently we are using l = 2^10 = 1024 in the draft text, which is based on the values from the DTLS 1.3 draft at [2], as is the p_q and p_v probability values. In that draft they motivate a chosen l value of 1024 as below. The paper referred to as AEBounds can be found at [3].

For simplicity, and to match the analysis of other AEAD functions in [AEBounds],

this analysis assumes a packet length of 2^10 blocks and a packet size limit of 2^14 bytes.

As you say it would be interesting to open a discussion on how the choice of limits for v & q, and the choice of l would affect applications.

Best wishes
Rikard Höglund

[1] https://gitlab.com/rikard-sics/draft-hoeglund-oscore-rekeying-limits/-/tree/v-01
[2] https://datatracker.ietf.org/doc/html/draft-ietf-tls-dtls13-43
[3] https://www.isg.rhul.ac.uk/~kp/TLS-AEbounds.pdf
________________________________
From: core <[email-masked]> on behalf of John Mattsson <john.mattsson=[email-masked]>
Sent: Thursday, April 29, 2021 11:57
To: Marco Tiloca <[email-masked]>; [email-masked] WG ([email-masked]) <[email-masked]>
Subject: Re: [core] CoRE WG Virtual Interim 2021-04-28

Hi,

Below are my thoughts after the interim yesterday:

- Two equally important reasons to rekey, AEAD limits and forward secrecy. A document
  updating OSCORE should treat both with equal weight.
- Frequent rekeying require efficient rekeying, should be published together.
- Other questions like error messages etc., needs to be specified at the same time.
- The limit setting process used in TLS is flawed and should probably not be used at all.
- The limits in TLS are secure, any limits equal or lower does not need motivation.
- Poly1305 v, GCM v, ChaCha20 q does not need any AEAD limits at all.
- CCM v, CCM q, GCM q should be rekeyed around 2^23 - 2^24.5 like in TLS
- CCM_8 v could be used much longer, maybe 2^35
- Should consider lowering l and CCM q compared to TLS to make CCM_8 behave even more like perfect MAC (right now the attacker can look at 2^23 messages and then send a single forgery attempt). This single forgery attempt succeds with probability 2^60.
- Might be easier to set simple limit of q, v = 2^20 or 2^23 for all algorithms.
- The limit l = 2^10 is measured in blocks (worst case), In bytes the limit is
  2^10 * 2^4 = 2^14 bytes = 16 kB.
- Can be discussed which limits should be MUST or SHOULD.
- Focus on discussion needs to be on how q,v,l limits and rekeying affect applications.

Cheers,
John

-----Original Message-----
From: core <[email-masked]> on behalf of Marco Tiloca <[email-masked]>
Date: Wednesday, 28 April 2021 at 14:04
To: "[email-masked] WG ([email-masked])" <[email-masked]>
Subject: Re: [core] CoRE WG Virtual Interim 2021-04-28

Dear all,

Just a reminder that we are having our virtual interim meeting in
slightly less than 2 hours [1].

Please find below the information to join.

Best,
Marco and Jaime

[1] https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fmeeting%2Finterim-2021-core-04%2Fsession%2Fcore&amp;data=04%7C01%7Crikard.hoglund%40ri.se%7Ce83bc850de51432bf32f08d90af54cac%7C5a9809cf0bcb413a838a09ecc40cc9e8%7C0%7C0%7C637552870935664628%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=XbKoAWMHXcBOWePeqmp1aev8%2B1TeNblv%2Fxy88Wc14S0%3D&amp;reserved=0

=== Meeting Information ===

Jabber: [email-masked]

Etherpad: https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcodimd.ietf.org%2Fnotes-ietf-interim-2021-core-04-core&amp;data=04%7C01%7Crikard.hoglund%40ri.se%7Ce83bc850de51432bf32f08d90af54cac%7C5a9809cf0bcb413a838a09ecc40cc9e8%7C0%7C0%7C637552870935664628%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=jxgsUJm%2FUKRJLra5tziAKZ0ykj3%2BDBZuANNfpFq%2B8jc%3D&amp;reserved=0

Meeting link:
https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fietf.webex.com%2Fietf%2Fj.php%3FMTID%3Dm888a990760425271a1327f53c6714b07&amp;data=04%7C01%7Crikard.hoglund%40ri.se%7Ce83bc850de51432bf32f08d90af54cac%7C5a9809cf0bcb413a838a09ecc40cc9e8%7C0%7C0%7C637552870935664628%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=TGdabtdwH9macsf4GjLHnbm1LWB8%2FwhXd%2BjgAEaA3hk%3D&amp;reserved=0

Meeting number: 185 248 9231
Password: constrained

More ways to join

Join by video system
Dial [email-masked]
You can also dial 173.243.2.68 and enter your meeting number.

Join by phone
1-650-479-3208 Call-in number (US/Canada)
Access code: 185 248 9231

On 2021-04-21 18:07, Marco Tiloca wrote:
> Dear all,
>
> Just a reminder that we'll have a virtual interim meeting on
> Wednesday, April 28th at 14:00 UTC. The agenda is available at [1].
>
> Best,
> Marco and Jaime
>
> [1]
> https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fmeeting%2Finterim-2021-core-04%2Fsession%2Fcore&amp;data=04%7C01%7Crikard.hoglund%40ri.se%7Ce83bc850de51432bf32f08d90af54cac%7C5a9809cf0bcb413a838a09ecc40cc9e8%7C0%7C0%7C637552870935674585%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=xdWZTxvyQUHx%2BtE1OfHQbSzdJ4s%2BlEPkoZjf0uGSCSs%3D&amp;reserved=0
>

--
Marco Tiloca
Ph.D., Senior Researcher

Division: Digital System
Department: Computer Science
Unit: Cybersecurity

RISE Research Institutes of Sweden
https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fprotect2.fireeye.com%2Fv1%2Furl%3Fk%3D4c4a5987-13d16165-4c4a191c-86073b36ea28-2adec21f03723771%26q%3D1%26e%3Ddc609331-6b2f-490c-b545-f937c703f065%26u%3Dhttps%253A%252F%252Fwww.ri.se%252F&amp;data=04%7C01%7Crikard.hoglund%40ri.se%7Ce83bc850de51432bf32f08d90af54cac%7C5a9809cf0bcb413a838a09ecc40cc9e8%7C0%7C0%7C637552870935674585%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=4j00cEttBTjyXGZlqcSQc7A1jPNqh1%2FsTGIS4C2kBpU%3D&amp;reserved=0

Phone: +46 (0)70 60 46 501
Isafjordsgatan 22 / Kistagången 16
SE-164 40 Kista (Sweden)

_______________________________________________
core mailing list
[email-masked]
https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fcore&amp;data=04%7C01%7Crikard.hoglund%40ri.se%7Ce83bc850de51432bf32f08d90af54cac%7C5a9809cf0bcb413a838a09ecc40cc9e8%7C0%7C0%7C637552870935674585%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=lZbIoAQ3X4pOV5ik%2B5G2ad%2Fc0EqFr%2Bmb98mt2EialzQ%3D&amp;reserved=0