netdev - Re: CCM/GCM implementation defect

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20150423231255.GA26635@gondor.apana.org.au>
Date:	Fri, 24 Apr 2015 07:12:55 +0800
From:	Herbert Xu <herbert@...dor.apana.org.au>
To:	Martin Willi <martin@...ongswan.org>
Cc:	Steffen Klassert <steffen.klassert@...unet.com>,
	netdev@...r.kernel.org, "David S. Miller" <davem@...emloft.net>,
	Paul Wouters <pwouters@...hat.com>,
	Linux Crypto Mailing List <linux-crypto@...r.kernel.org>
Subject: Re: CCM/GCM implementation defect

On Thu, Apr 23, 2015 at 03:24:59PM +0200, Martin Willi wrote:
>
> Do you have any pointer for me where this is defined? Why is it needed,
> given that GCM implicitly authenticates the IV by using it in Y0?

The IV if present must be covered by the ICV.  This is required
by RFC4303 (section 2).  But really it's quite obvious.  If you
don't authenticate the IV, then I can easily inject random crap
into your network by changing the IV.

Cheers,
-- 
Email: Herbert Xu <herbert@...dor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html