Subject: [Ietf-krb-wg] More on CCM

From: Luke Howard <[email-masked]>
Date: Fri, 14 May 2010 12:59:27 +0200

Gentlefolk,

I've tried to write up a bit more about the implementation of Camellia-CCM and AES-CCM in MIT Kerberos. Doing it formally will require additional work to harmonise the differing nomenclature between NIST SP800-38C (the CCM spec) and RFC 3961. I would like to strike a balance between not re-specifying CCM and producing something that makes sense in the context of RFC 3961.

-- Luke

                          Cryptosystem from CCM Profile
------------------------------------------------------------------------
protocol key format       As given.

specific key structure    Two protocol-format keys: { Kc, Ke }.

key-generation seed       As given.
length

required checksum         As defined below.
mechanism

cipher state              correctly formatted counter block per NIST SP800-38C A.3

initial cipher state      counter block with nonce N = 0 and index i = 0

encryption function       adata = associated data
                          N = random string of length n
                          Q = binary representation of octet length of plaintext of length q
                          i = counter index
                          B0 = Flags | N | Q
                          Ctr0 = Flags | N | [i]8q
                          oldstate.ivec = Ctr0
                          T = CBC-MAC(Ke, B0 | adata_len | adata_pad | pad | plaintext | pad)
                          (H1, Ctr1) = E(Ke, T, Ctr0)
                          (C1, Ctrm) = E(Ke, plaintext, Ctr1)
                          newstate.ivec = Ctrm
                          ciphertext = N | C1 | H1

decryption function       (N,C1,H1) = ciphertext
                          oldstate.ivec = Ctr0
                          (T, Ctr1) = D(Ke, H1, Ctr0)
                          (P1, Ctrm) = D(Ke, C1, Ctr1)
                          if (T != CBC-MAC(Ke, B0 | adata_len | adata | adata_pad | plaintext | pad))
                             report error
                          newstate.ivec = Ctrm

default string-to-key     As given.
params

pseudo-random function    PRF = CMAC(DK(protocol-key, prfconstant),
                                     octet-string)

   The "prfconstant" used in the PRF operation is the three-octet string
   "prf".

key generation functions:

string-to-key function    As given.

random-to-key function    As given.

key-derivation function   The "well-known constant" used for the DK
                          function is the key usage number, expressed as
                          four octets in big-endian order, followed by
                          one octet indicated below.

                          Kc = DK(base-key, usage | 0x99);
                          Ke = DK(base-key, usage | 0xCC);

                Checksum Mechanism from CCM Profile
             --------------------------------------------------
             associated cryptosystem   As defined above.

             get_mic                   CMAC(Kc, message)

             verify_mic                get_mic and compare

  +--------------------------------------------------------------------+
  |               protocol key format        128- or 256-bit string    |
  |                                                                    |
  |            string-to-key function        PBKDF2+DK with variable   |
  |                                          iteration count (see      |
  |                                          above)                    |
  |                                                                    |
  |  default string-to-key parameters        00 00 10 00               |
  |                                                                    |
  |        key-generation seed length        key size                  |
  |                                                                    |
  |            random-to-key function        identity function         |
  |                                                                    |
  |                   nonce length, n        12 octets (96 bits)       |
  |                                                                    |
  |                     tag length, t        16 octets (128 bits)      |
  |                                                                    |
  |                 counter length, q        3 octets (24 bits)        |
  |                                                                    |
  |             message block size, m        1 octet                   |
  |                                                                    |
  |  encryption/decryption functions,        AES in CTR mode           |
  |  E and D                                 (cipher block size 16     |
  |                                          octets), with initial     |
  |                                          counter block as ivec     |
  +--------------------------------------------------------------------+

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Luke Howard <[email-masked]>
Date: Fri, 14 May 2010 19:22:48 +0200

Continuing my habit of following up on my own e-mails: it seems simpler to specify cipher state chaining (which doesn't seem to be used that much anyway in modern Kerberos applications) if we use a fresh nonce for each invocation of the encryption function.

In the following, the cipher state just contains the counter (although for consistency it is specified as a counter block with an empty nonce).

cipher state              Flags | [0]8n | [i]8q (formatted per NIST SP800-38C A.3)
 
initial cipher state      counter index i = 0

encryption function       adata = associated data
                          N = random nonce of length n
                          Q = binary representation of octet length of plaintext of length q
                          i = counter index
                          m = number of blocks
                          B0 = Flags | N | Q
                          Ctr0 = Flags | N | oldstate.i
                          T = CBC-MAC(Ke, B0 | adata_len | adata_pad | pad | plaintext | pad)
                          (H1, Ctr1) = E(Ke, T, Ctr0)
                          (C1, Ctrm) = E(Ke, plaintext, Ctr1)
                          ciphertext = N | C1 | H1
                          newstate.i = Ctrm.i

                          Ctr0 = Flags | N | oldstate.i
                          newstate.i = Ctrm.i

-- Luke