Hi Security Folks,

This is the only comment received so far concerning mandating GCM vs. CBC for IKEv2-SCSI, and it recommends using CBC.  The current IKEv2-SCSI draft specifies CBC-HMAC, so we'll keep it that way unless anyone else wants to defend GCM.

Thanks,
-Matt

On 10/15/07, Subhash Sankuratripati  wrote:
Matt,
 
NetApp is against the use of GCM (in 256-bit mode) with the assumption that the block size of GCM (per SP 800-38D) is 128 bits.
 
Authentication strength unlike Encryption Strength is limited by block size. Hence it is our opinion that GCM cannot be used in 256-bit mode of operation.
 
Thanks,
-Subhash.

From:  Matt Ball
Sent: Wednesday, September 19, 2007 5:06 PM
To: t10
Cc: David Black
Subject: SPC-4, 07-449r9: Should we mandate AES-GCM or AES-CBC-HMAC for IKEv2-SCSI

Now that we've preliminarily decided to allow both the 128-bit and 256-bit columns in IKEv2-SCSI (T10/07-449), the next straw poll for the group is to decide which symmetric encryption mode to mandate for IKEv2-SCSI.  The choices are as follows:

a) AES-GCM; or
b) AES-CBC-HMAC-SHA

GCM is generally faster in both software and hardware implementations.  CBC-HMAC-SHA is currently FIPS 140-2-approved (SP 800-38A + FIPS 198a + FIPS 180-2).  However, NIST will likely approve SP 800-38D (GCM) by the time IKEv2-SCSI is finished.

Please check with your crypto dudes and let David Black and me know which choice you prefer, and whether this is a strong preference.  I'm hoping we can resolve this by the next CAP security conference call, or Vegas at the latest.

--
Thanks!
Matt Ball
IEEE SISWG Chair
303-717-2717
http://www.linkedin.com/in/matthewvball