Subject: Re: [ntpwg] Minor correction on draft-aanchal4-ntp-mac

From: Aanchal Malhotra <[email-masked]>
Date: Tue, 2 May 2017 17:08:24 -0400

Hi Scott,

Thanks for pointing this out. I agree that if nonce is reused even once to
MAC two different messages with the same key, Poly1305 key can be
recovered. I will update the draft-aanchal4-ntp-mac.

However, the final MAC-for-NTP recommendation is in this draft
<https://tools.ietf.org/html/draft-ietf-ntp-mac-00> (which does not contain
this block of text.)

Thanks,
Aanchal.

On Fri, Apr 28, 2017 at 3:12 PM, Scott Fluhrer (sfluhrer) <
[email-masked]> wrote:

> The draft claims that
>
>
>
> 2.  The other three algorithms evaluated here do not suffer from
>
>        nonce reuse vulnerabilities where an adversary can recover the
>
>        authentication key if the nonce is reused just once.
>
>
>
> Actually, this is not true; if you use the same nonce to MAC two different
> messages with Poly1305(ChaCha20) (specifically, the RFC7539 version), an
> attacker will be able to forge (just with that nonce, however since the
> attacker gets to select the nonce, that doesn’t help much).
>
>
>
> Now, this doesn’t change the conclusion of the draft, which is to use CMAC
> (which I agree with); I just wanted to make sure that, should you
> reevaluate things and reconsider Poly1305, that you would be aware of the
> issues.
>
> _______________________________________________
> ntpwg mailing list
> [email-masked]
> http://lists.ntp.org/listinfo/ntpwg
>
_______________________________________________
ntpwg mailing list
[email-masked]
http://lists.ntp.org/listinfo/ntpwg

---

From: "Scott Fluhrer (sfluhrer)" <[email-masked]>
Date: Wed, 3 May 2017 03:22:37 +0000

To be precise, you don’t actually recover any keying material.  What you do recover are the (r, s) values corresponding to the nonce (which is enough for an attacker to forge with that nonce).

From: Aanchal Malhotra [mailto:[email-masked]]
Sent: Tuesday, May 02, 2017 5:08 PM
To: Scott Fluhrer (sfluhrer)
Cc: [email-masked]
Subject: Re: [ntpwg] Minor correction on draft-aanchal4-ntp-mac

Hi Scott,
Thanks for pointing this out. I agree that if nonce is reused even once to MAC two different messages with the same key, Poly1305 key can be recovered. I will update the draft-aanchal4-ntp-mac.
However, the final MAC-for-NTP recommendation is in this draft<https://tools.ietf.org/html/draft-ietf-ntp-mac-00> (which does not contain this block of text.)
Thanks,
Aanchal.

On Fri, Apr 28, 2017 at 3:12 PM, Scott Fluhrer (sfluhrer) <[email-masked]<mailto:[email-masked]>> wrote:
The draft claims that

Actually, this is not true; if you use the same nonce to MAC two different messages with Poly1305(ChaCha20) (specifically, the RFC7539 version), an attacker will be able to forge (just with that nonce, however since the attacker gets to select the nonce, that doesn’t help much).

Now, this doesn’t change the conclusion of the draft, which is to use CMAC (which I agree with); I just wanted to make sure that, should you reevaluate things and reconsider Poly1305, that you would be aware of the issues.

_______________________________________________
ntpwg mailing list
[email-masked]<mailto:[email-masked]>
http://lists.ntp.org/listinfo/ntpwg

---

From: Aanchal Malhotra <[email-masked]>
Date: Tue, 2 May 2017 23:36:27 -0400

Hi Scott,

On Tue, May 2, 2017 at 11:22 PM, Scott Fluhrer (sfluhrer) <
[email-masked]> wrote:

> To be precise, you don’t actually recover any keying material.  What you
> do recover are the (r, s) values corresponding to the nonce (which is
> enough for an attacker to forge with that nonce).
>

You are right. And that's exactly what I meant by Poly1305 key.

Precisely, pair (r,s) is 32-byte unique (corresponding to nonce) key for
"Poly1305". r may be a constant value but s should be unique, given the
nonce is unique for the same key. However, when s repeats (given the same k
and repeated nonce), for two different messages the pair (r,s) is
recoverable. And so the attacker can forge with that nonce.

>
>
> *From:* Aanchal Malhotra [mailto:[email-masked]]
> *Sent:* Tuesday, May 02, 2017 5:08 PM
> *To:* Scott Fluhrer (sfluhrer)
> *Cc:* [email-masked]
> *Subject:* Re: [ntpwg] Minor correction on draft-aanchal4-ntp-mac
>
>
>
> Hi Scott,
>
> <https://tools.ietf.org/html/draft-ietf-ntp-mac-00> (which does not
> contain this block of text.)
>
> Thanks,
>
> Aanchal.
>
>
>

---

From: Danny Mayer <[email-masked]>
Date: Wed, 31 May 2017 22:24:52 -0400

I think this is ready for adoption. There is one change that should be
made to indicate that this draft/RFC updates RFC5905. I believe that
should be in the header of the document. Karen will be able to confirm.

Danny