[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Proposed changes to ESP (andf a little AH too)
Lewis,
It is true that moving the counter and the HMAC outside of the
encryption boundary does remove a source of unpredictable plaintext from
the message. However, the HMAC is at the end of the message, and the use
of an IV in feedback modes is designed to provide an unpredictable starting
point for the encryption process. If the contents of the message are
predictable, as suggested, then there typically will be enough plaintext to
support a known plaintext attack irresepctive of the posotioning of the
counter value. See Steve Bellovin's recent paper (in the Proceedings of
the Symposium on Network and Distributed System Security, Feb 97) analyzing
such attacks in a typical IP/TCP context.
Steve
References: