Subject: Re: [Ietf-krb-wg] Camellia-CTS for Kerberos

From: Luke Howard <[email-masked]>
Date: Sun, 9 May 2010 20:47:09 +0200

Regarding implementing Camellia-CCM (admittedly otherwise unspecified and off-topic), would one prefer the mandatory Kerberos checksum type to be SHA-1 (-512?) or CMAC? (Note this is orthogonal to the use of CBC-MAC in CCM itself.)

CMAC is arguably more consistent with CCM (see NIST 800-38C section 5.2).

-- Luke
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Greg Hudson <[email-masked]>
Date: Sun, 09 May 2010 19:25:40 -0400

> CMAC is arguably more consistent with CCM (see NIST 800-38C section 5.2).

I would prefer to avoid a separate hash algorithm for enctypes using an
AEAD mode.  The primary value from my point of view of an AEAD
Camellia-based enctype is that it acts as a ready fallback position if
vulnerabilities are discovered in AES, SHA-1, or (perhaps outlandishly)
the cipher/hash composition used in the AES-CTS enctypes.

---

From: Ken Raeburn <[email-masked]>
Date: Sun, 9 May 2010 19:53:47 -0400

> CMAC is arguably more consistent with CCM (see NIST 800-38C section 5.2).

I think I'd definitely recommend going with CMAC with CCM.  The security of a Kerberos encryption mechanism, *as used in Kerberos*, is dependent in part on the security of the associated checksum scheme.  So even though they can be chosen somewhat independently, I think relying on SHA-1 or SHA-512 in addition to CMAC is unnecessary.

(In fact, if I was designing Kerberos crypto from scratch right now, I think I'd start with AEAD modes only, and not do "encrypt" and "checksum" as independent algorithms.)

The only part that would concern me is if "encrypt" and "checksum" generate the same or related output (or something easily converted by an attacker) when the input is an empty string, and I'm not even sure how much of an issue that would be.  Of course, I'd want to see detailed specs....

Ken

---

From: Luke Howard <[email-masked]>
Date: Mon, 10 May 2010 15:25:59 +0200

The users/lhoward/camellia-ccm branch of MIT Kerberos contains an implementation of both CCM and CMAC, for both AES and Camellia. The mandatory checksum type for the CCM enctypes is CMAC. (However, as mentioned before, integrity in CCM is provided through CBC-MAC.)

#define ENCTYPE_AES128_CCM_128  -64
#define ENCTYPE_AES256_CCM_128  -65
#define ENCTYPE_CAMELLIA128_CCM_128 -66
#define ENCTYPE_CAMELLIA256_CCM_128 -67

#define CKSUMTYPE_CMAC_128_AES128              -64
#define CKSUMTYPE_CMAC_128_AES256              -65
#define CKSUMTYPE_CMAC_128_CAMELLIA128         -66
#define CKSUMTYPE_CMAC_128_CAMELLIA256         -67

-- Luke

--
www.padl.com | www.thisismagnolia.net