210 likes | 698 Views
An Interface and Algorithms for Authenticated Encryption (RFC 5116). David McGrew mcgrew@cisco.com. Authenticated Encryption with Associated Data (AEAD). Single algorithm provides confidentiality and authenticity/integrity protection Useful abstraction for ‘ideal’ encryption
E N D
An Interface and Algorithms for Authenticated Encryption (RFC 5116) David McGrew mcgrew@cisco.com
Authenticated Encryption with Associated Data (AEAD) • Single algorithm provides confidentiality and authenticity/integrity protection • Useful abstraction for ‘ideal’ encryption • Block cipher modes • GCM, CCM, SIV, and others • Dedicated algorithms • Phelix, SOBER-128
RFC 5116 • Defines interface to AEAD algorithms • Defines four algorithms • AES GCM, AES CCM • Defines IANA registry for algorithms
Example: Packet Protection Needs Authentication Header Payload Needs Confidentiality
Plaintext Header Payload Plaintext AEAD Encryption Plaintext is encrypted and authenticated
Associated Data Header Payload Associated Data Plaintext AEAD Encryption Associated Data is only authenticated
Secret key Header Payload Associated Data Plaintext AEAD Encryption Key
Nonce Header Payload Associated Data Plaintext AEAD Encryption Key Nonce Each encryption operation MUST have a distinct nonce
(Authenticated) Ciphertext Header Payload Associated Data Plaintext AEAD Encryption Key Nonce Ciphertext
Using AEAD Header Payload Associated Data Plaintext AEAD Encryption Key Nonce Ciphertext Header Nonce Protected Payload
Example: ESP P = RestOfPayloadData || TFCpadding || Padding || PadLength || NextHeader N = Salt || IV A = SPI || SequenceNumber ESP = SPI || SequenceNumber || IV || C
AEAD Benefits • Interface hides algorithm details from application • Application designer relieved of crypto issues • Promotes algorithm agility • Admits crypto optimizations • Simplifies analysis and testing
RFC 5116 Uses • ESP • Backwards compatible with RFC 4106 • TLS • ecc-new-mac, rsa-aes-gcm • IKE • draft-black-ikev2-aead-modes • SRTP, SSH work underway • 802.1AE
AEAD Algorithms • AES Galois/Counter Mode (GCM) • AES Counter & CBC-MAC (CCM) • AEAD_AES_128_CCM_SHORT • AES Synthetic IV (SIV) • draft-harkins-tls-rsa-aes-siv-00 • AES CBC, HMAC-SHA1 • draft-mcgrew-aead-aes-cbc-hmac-sha-00
Issues & Future Work • Nonces aren’t user friendly • Security and usability • No nonceless algorithms in registry yet
Acknowledgements • Thanks are due to: Hal Finney, Greg Rose, Russ Housley, Alfred Hines, John Wilkinson, Jack Lloyd, Scott Fluhrer, David Wagner, Ken Raeburn, Wei Dai, Aaron Christensen, Phil Rogaway, and Dan Harkins • IRTF CFRG participants