Subject: [core] New Version Notification for draft-hoeglund-core-oscore-key-limits-01.txt

From: Rikard Höglund <[email-masked]>
Date: Fri, 16 Jul 2021 11:37:21 +0000

Hello CoRE,

We have submitted an update for the draft "Key Update for OSCORE" --- previously known as "AEAD Key Usage Limits in OSCORE".
https://datatracker.ietf.org/doc/html/draft-hoeglund-core-oscore-key-limits-01

This document considers the CFRG draft at [1], and accordingly defines how two peers using OSCORE must take limits of the used AEAD algorithm into account, and what steps to take in order to preserve the security of their communications, e.g., performing a rekeying. Also, this document specifies a lightweight method that two peers can use to update their keying material and establish a new OSCORE Security Context.

Building on what discussed during the CoRE interim at [2], this update covers especially the following points:
1) The proposed key limits have been revised, mostly based on input from John Mattsson as per slide 11 of [3].
2) As reflected by the title change, the document scope has been broadened to include also a key update method, that the two peers can use to update their OSCORE Security Context.

Comments are very welcome!

[1] https://datatracker.ietf.org/doc/draft-irtf-cfrg-aead-limits/
[2] https://datatracker.ietf.org/meeting/interim-2021-core-04/session/core
[3] https://datatracker.ietf.org/meeting/110/materials/slides-110-saag-analysis-of-usage-limits-of-aead-algorithms-00.pdf

Best wishes
Rikard Höglund

________________________________
From: [email-masked] <[email-masked]>
Sent: Monday, July 12, 2021 16:37
To: Rikard Höglund <[email-masked]>; Marco Tiloca <[email-masked]>; Rikard Höglund <[email-masked]>
Subject: New Version Notification for draft-hoeglund-core-oscore-key-limits-01.txt

A new version of I-D, draft-hoeglund-core-oscore-key-limits-01.txt
has been successfully submitted by Rikard Höglund and posted to the
IETF repository.

Name:           draft-hoeglund-core-oscore-key-limits
Revision:       01
Title:          Key Update for OSCORE
Document date:  2021-07-12
Group:          Individual Submission
Pages:          21
URL:            https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Farchive%2Fid%2Fdraft-hoeglund-core-oscore-key-limits-01.txt&amp;data=04%7C01%7Crikard.hoglund%40ri.se%7Ca852159407fe4157e00d08d94542969d%7C5a9809cf0bcb413a838a09ecc40cc9e8%7C0%7C0%7C637616974557681475%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=kPrsqBxyArLYJ%2F2GStdR3Y1ue4tc1Q7AVCIDmMY%2FjgU%3D&amp;reserved=0
Status:         https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-hoeglund-core-oscore-key-limits%2F&amp;data=04%7C01%7Crikard.hoglund%40ri.se%7Ca852159407fe4157e00d08d94542969d%7C5a9809cf0bcb413a838a09ecc40cc9e8%7C0%7C0%7C637616974557681475%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=t8CQXg608X5QAk9MjfScx%2FhojlgBXtonN%2BeDcKXPAqE%3D&amp;reserved=0
Html:           https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Farchive%2Fid%2Fdraft-hoeglund-core-oscore-key-limits-01.html&amp;data=04%7C01%7Crikard.hoglund%40ri.se%7Ca852159407fe4157e00d08d94542969d%7C5a9809cf0bcb413a838a09ecc40cc9e8%7C0%7C0%7C637616974557686445%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=KqlGT%2F2atIi30rDaEEqMiU%2FVypdFhismYAffqvK%2FtCA%3D&amp;reserved=0
Htmlized:       https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Fdraft-hoeglund-core-oscore-key-limits&amp;data=04%7C01%7Crikard.hoglund%40ri.se%7Ca852159407fe4157e00d08d94542969d%7C5a9809cf0bcb413a838a09ecc40cc9e8%7C0%7C0%7C637616974557686445%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=6KdeONArX%2Bc3VJSmMt%2BWKC0VpFm3UgGvrL8bleKT5qo%3D&amp;reserved=0
Diff:           https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Frfcdiff%3Furl2%3Ddraft-hoeglund-core-oscore-key-limits-01&amp;data=04%7C01%7Crikard.hoglund%40ri.se%7Ca852159407fe4157e00d08d94542969d%7C5a9809cf0bcb413a838a09ecc40cc9e8%7C0%7C0%7C637616974557686445%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=itYHNW%2FKFsWR7x3cn50HsrKLKqN7wb9wazh3HqeEQiE%3D&amp;reserved=0

Abstract:
   Object Security for Constrained RESTful Environments (OSCORE) uses
   AEAD algorithms to ensure confidentiality and integrity of exchanged
   messages.  Due to known issues allowing forgery attacks against AEAD
   algorithms, limits should be followed on the number of times a
   specific key is used for encryption or decryption.  This document
   defines how two OSCORE peers must follow these limits and what steps
   they must take to preserve the security of their communications.
   Therefore, this document updates RFC8613.  Furthermore, this document
   specifies a lightweight method that two peers can use to update their
   keying material and establish a new OSCORE Security Context.

The IETF Secretariat

---

From: Michael Richardson <[email-masked]>
Date: Fri, 16 Jul 2021 10:51:27 -0400

Rikard Höglund <rikard.hoglund=[email-masked]> wrote:
    > This document considers the CFRG draft at [1], and accordingly defines
    > how two peers using OSCORE must take limits of the used AEAD algorithm
    > into account,

Good.

    > and what steps to take in order to preserve the security
    > of their communications, e.g., performing a rekeying. Also, this
    > document specifies a lightweight method that two peers can use to
    > update their keying material and establish a new OSCORE Security
    > Context.

I'm concerned that this part will need significantly far more review, and
should be split off into a new document.
Maybe even, punt it into LAKE.

but, in the meantime, can you ask the authors of cfrg-aead-limits to review?

    > 1) The proposed key limits have been revised, mostly based on input
    > from John Mattsson as per slide 11 of [3].

    > 2) As reflected by the title change, the document scope has been
    > broadened to include also a key update method, that the two peers can
    > use to update their OSCORE Security Context.

--
Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide