6.2.9 and CCM-8

[randomstuff]

Since #2482, 6.2.9 is:

6.2.9 [ADDED] Verify that all cryptographic primitives utilize a minimum of 128-bits of security based on the algorithm, key size, and configuration. For example, a 256-bit ECC key provides roughly 128 bits of security where RSA requires a 3072-bit key to achieve 128 bits of security.

CCM-8 is still listed in the approved algorithms. However, its authentication tag only has 64 bits of security and does not respect this minimum of 128-bits of security.

There seems to be a conflict between these. How should be fix this?

Possible options:

• add some exception in 6.2.9 in order to allow CCM-8 in certain contexts ("unless some additional measure to prevent forgery of messages is used");
• do not approve CCM-8.

I don't have a strong opinion on this and I don't know if CCM-8 is really used/useful nowadays. The safest choice seems to disapprove CCM-8. Unless/until someone come forwards with further input, I would suggest taking this approach.

See as well discussion in #2413 for more info about CCM-8.

[jmanico]

Seems like getting rid of it is the right way to go.

[tghosth]

@randomstuff can you prepare a PR that captures the feedback from this issue and also #2143.

Does using the disclaimer from here help with this issue?
#2413 (comment)

It sounds like they did have a reason for including it so I would be cautious about reversing it.

[tghosth]

Ping @randomstuff :)

[randomstuff]

Woops sorry, I'll do that!

By the way, I think you linked to the wrong issue in your previous comment :)

[randomstuff]

@unprovable, any opinion on this?

[randomstuff]

I searched https://clienttest.ssllabs.com:8443 and did not find a client with support for this (is it supported by the TLS client test?). I made a PR to disapprove it. I believe it won't be missed.

If anyone thinks it should be approved, please comment here.

[tghosth]

I don't think I did link to the wrong comment. In the comment I linked, @unprovable gives a reason why they included CCM-8. I don't really want to just straight out delete it and not take that into account.

[randomstuff]

Woops sorry, indeed the link was correct :)

I tried to find any actual usage of CCM-8. This only thing I found is a draft “Comparison of CoAP Security Protocols”. I think CCM-8 is expected to be useful for very constrained environments (IoT with CoAP, 6LoWPAN?) but is not used for general (web) traffic.

Now we have several options:

1. have some inconsistency between 6.2.9 and the list of approved modes of operations;
2. add some form of exception in 6.2.9 (“As an exception, 64 bit MAC tags are allowed (eg. CCM-8) if no more than 128 messages can be accepted.”);
3. mark CCM-8 as disallowed;
4. remove any mention of CCM-8 🙈.

I would suggest solution (3) for consistency. If someone raises any issue with this, (2) would be an option.

@unprovable, any recommendation on that?

[unprovable]

Hello! Apologies for delayed response time!

So, as much as I'd like to go with 4 (no mention) it is a NIST standard (NIST SP800-38) and so it really should be covered. They're updating that standard - public consultation ended last Sept (see the consultation page so likely this is all about to change anyway.

In light of this, and in light of the fact that "CCM-8 and co. come from 2007 and that was a long time ago" perhaps (3) (disallow CCM-8) is the best option.

Hope this is helpful! M.

[tghosth]

@randomstuff can you update the PR?

[unprovable]

I think that might have to be a @danielcuthbert activity (I didn't make the original PR's, just heavily involved in the drafting our side). Apologies!

[tghosth]

I think that might have to be a @danielcuthbert activity (I didn't make the original PR's, just heavily involved in the drafting our side). Apologies!

We've had a few instances where @randomstuff has prepared PRs for @danielcuthbert to review so I think it is ok

[randomstuff]

I have updated the PR to include this note:

When using CCM-8, the MAC tag only has 64 bits of security. This does not conform to requirement 6.2.9 which requires at least 128 bits of security.

Is that OK for you? @unprovable @danielcuthbert

[jmanico]

CCM-8 should only be used in legacy enviornments where performance in low resource devices is more important than security. If security is your priority, you should never touch this weak algorithm. Especially when you are doing server-side development. I only see CCM-8 recently used in low power handheld legacy devices, but new web server development should never even think of using this.

[unprovable]

@tghosth I couldn't, but all the folk you mention have 'contributor'. @randomstuff I think this is a good thing to note on the PR.

[tghosth]

Merged in #2534