CRC Issue in Security Draft

[P.Pillai@Bradford.ac.uk]

Hi Haitham and Sunny,

I have a few questions regarding your security
draft(draft-cruickshank-ipdvb-sec-01.txt):

1) I am not sure as to what is the main reason for encrypting the entire PDU
including the checksum as indicated by the draft on Page 4? As indicated in the
RFC4326, section 7.2 the receiver should be able validate the CRC as soon as it
gets the complete SNDU in the buffer. I do not think that encrypting of this
CRC is a good idea, as this would violate the standard processing of the ULE
SNDU, where it would be have to skip this CRC check and first perform
decryption of the packets and then come back and perform the CRC check. (Hence
it can no longer be just an extension header for ULE, as the processing has
changed)

2) Even if the CRC is not encrypted, another major conflict in the SNDU format
is the presence of the integrity block after your CRC. At the receiver side as
indicated in the RFC4326, section 7.2 the receiver should be able validate the
CRC as soon as it gets the complete SNDU in the buffer. At this stage the ideal
working of the receiver (for standard ULE) is to take the last 32 bits which
would be the CRC and perform the CRC check. But now the CRC is not at the end
and it may be difficult to extract the CRC from the SNDU especially because the
integrity block has not shown to have fixed size.

3) Also it is not clear why is the CRC required when the integrity block is
present. The integrity block would be using much complex algorithms like HMACs
etc to detect if there is any change in the transmitted data and the received
data. This change could have resulted by an attacker modifying the message or
could have also been due to transmission/processing errors. In either case the
packets should be discarded. So does this not mean that the CRC is only
duplicating the work and may not be really required when we have a stronger
integrity block?

Regards
Prashant


-- 
Prashant Pillai
Research Assistant
School of Engineering, Design and Technology
University of Bradford
Bradford, BD7 1DP
West Yorkshire
United Kingdom
Phone: 0044-1274-233720
email: p.pillai@bradford.ac.uk
------------------------------------------------------------
This mail sent through IMP: http://webmail.brad.ac.uk
To report misuse from this email address forward the message
and full headers to misuse@bradford.ac.uk
------------------------------------------------------------