Subject: [MSEC] [Technical Errata Reported] RFC5776 (2155)

From: RFC Errata System <[email-masked]>
Date: Fri, 9 Apr 2010 04:49:41 -0700 (PDT)

The following errata report has been submitted for RFC5776,
"Use of Timed Efficient Stream Loss-Tolerant Authentication (TESLA) in the Asynchronous Layered Coding (ALC) and NACK-Oriented Reliable Multicast (NORM) Protocols".

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata_search.php?rfc=5776&eid=2155

--------------------------------------
Type: Technical
Reported by: ALfred Hoenes <[email-masked]>

Section: 6.2.1,pg.52

Original Text
-------------
|  o  direct time synchronization response: Upon receiving a response, a
      receiver who has no pending request MUST immediately drop the
      packet.  If this receiver has previously issued a request, he
|     first checks the Group MAC (if applicable), then the "t_r" field,
|     to be sure it is a response to his request, and finally the
      digital signature.  A replayed packet will be dropped during these
      verifications, without compromising the TESLA component.

Corrected Text
--------------
|  o  Direct time synchronization response: Upon receiving a response, a
      receiver who has no pending request MUST immediately drop the
      packet.  If this receiver has previously issued a request, he
|     first checks the "t_r" field, to be sure it is a response to his 
|     request, then the Group MAC (if applicable), and finally the
      digital signature.  A replayed packet will be dropped during these
      verifications, without compromising the TESLA component.

Notes
-----
Rationale:
a) [supplemental, editorial] capitalization after preceding full stop;
b) conflict with reasonable specification in section 4.2.2.1:
   the "t_r" field match with an 'open' request is a very lightweight
   operation, and an attacker needs to be on-path and fast or *very*
   lucky to happen to pass this check; so performing the more costly
   Group MAC verification operation _only_ if the packet "t_r" matches
   an open request significantly reduces  the workload an attacker can
   impose on the receiver; thus, the order of operations specified in
   Section 4.2.2.1 is an important detail of the overall anti-DoS
   strategy and should not be contradicted by the Security
   Considerations section.

Instructions:
-------------
This errata is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party (IESG)
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC5776 (draft-ietf-msec-tesla-for-alc-norm-10)
--------------------------------------
Title               : Use of Timed Efficient Stream Loss-Tolerant Authentication (TESLA) in the Asynchronous Layered Coding (ALC) and NACK-Oriented Reliable Multicast (NORM) Protocols
Publication Date    : April 2010
Author(s)           : V. Roca, A. Francillon, S. Faurite
Category            : EXPERIMENTAL
Source              : Multicast Security
Area                : Security
Stream              : IETF
Verifying Party     : IESG