Re: draft-miller-secsh-umac-00.txt

[Damien Miller <djm%mindrot.org@localhost>]

On Thu, 14 Jun 2007, Damien Miller wrote:

> On Wed, 13 Jun 2007, Wei Dai wrote:
>
> > Both UMAC and VMAC require unique nonces. Using the sequence number
> > as the nonce as in your draft may cause nonces to be reused if
> > someone takes a snapshot of an active SSH connection running an a
> > virtual machine, and when that snapshot is restored, the SSH program
> > sends out new packets before realizing that the connection is no
> > longer valid.
> >
> > Unless there is a good reason to believe this can't occur, it would
> > be safer to use random nonces instead.

Markus Friedl suggested a good compromise: use the KEX PRF to extract
192 bits of MAC key, give the first 128 to UMAC and use the remaining 64
bits as a "nonce seed".

The nonce that is supplied to UMAC can be nonce_seed + sequence_number.
The seed would be private like the other keying material and, while the
nonces would still be reused under this attack, the actual nonce values
would be not be known to the attacker.

This tweak does not need any new PRF, and it preserves UMACs
optimisation when the nonce is a monotonic big endian counter.

Thoughts?

-d