TCP Authentication Option, as specified in RFC 5925, can use different
algorithms for key derivation and MAC computation. RFC 5926 specified
KDF_HMAC_SHA1/HMAC_SHA_1_96 and KDF_AES_128_CMAC/AES_128_CMAC_96.
In the TCPM WG currently two IDs defining additional algorithms are being
discussed: draft-ietf-tcpm-tcp-ao-algs and draft-bonica-tcpm-tcp-ao-long-algs.
Here is an overview about the algorithms:
KDF | MAC | Len | Spec
-----------------|-----------------|-----|------------------------------------
KDF_HMAC_SHA1 | HMAC_SHA_1_96 | 12 | RFC 5926
KDF_AES_128_CMAC | AES_128_CMAC_96 | 12 | RFC 5626
HKDF-SHA256 | HMAC-SHA256-128 | 16 | draft-ietf-tcpm-tcp-ao-algs
KMAC256-KDF | KMAC256-128 | 16 | draft-ietf-tcpm-tcp-ao-algs
HKDF-SHA384 | HMAC-SHA384 | 48 | draft-bonica-tcpm-tcp-ao-long-algs
KMAC384-KDF | KMAC384 | 48 | draft-bonica-tcpm-tcp-ao-long-algs
Question group 1:
(a) Are the algorithms HKDF-SHA256/HMAC-SHA256-128 and KMAC256-KDF/KMAC256-128
proposed in draft-ietf-tcpm-tcp-ao-algs significantly better than the ones
specified in RFC 5926?
(b) Would other algorithms with similar output length be significantly better
than the proposed ones?
Question group 2:
(c) Are the algorithms HKDF-SHA384/HMAC-SHA384 and KMAC384-KDF/KMAC384
proposed in draft-bonica-tcpm-tcp-ao-long-algs significantly better than
the ones specified in draft-ietf-tcpm-tcp-ao-algs?
(d) Would other algorithms with similar output length be significantly better
than the proposed ones?
(e) What is the timeline for switching to longer MACs like in
draft-bonica-tcpm-tcp-ao-long-algs? Is there an immediate need, for
example due to PQ.
Please note that the available space in the TCP header available for the MAC
is limited. The algorithms proposed in draft-ietf-tcpm-tcp-ao-algs do not
require a TCP modification whereas the ones proposed in
draft-bonica-tcpm-tcp-ao-long-algs actually do require TCP modifications.