Subject: [Hipsec] bug in E3 in the state machine?

From: [email-masked] (Henderson, Thomas R)
Date: Thu Nov 6 11:26:02 2003

I agree, under normal cases of no reordering, this should not
happen.  You should only get R1 if you have sent I1.  If you=20
send I1, you are by definition in state E1.  So we should not=20
be processing R1 while in state E3.=20

I would suggest:
"Receive R1, drop and stay at E3"

Tom

> -----Original Message-----
> From: Miika Komu [mailto:[email-masked]]
> Sent: Thursday, November 06, 2003 8:21 AM
> To: [email-masked]
> Subject: [Hipsec] bug in E3 in the state machine?
>=20
>=20
> draft-08, section 5.4.2_
>=20
>    +---------+
>    |    E3   | HIP SA established
>    +---------+
>    ..
>    Receive R1, process with SA and Birthday check
>         if successful, send I2, prepare to drop old SA and cycle at E3
>    ..
>    Receive R2, drop and stay at E3
>=20
> Receive R1, send I2 but drop the incoming R2? Is there are=20
> bug here or did
> I misunderstand something?
>=20
> --=20
> Miika Komu              [email-masked]          http://www.iki.fi/miika/
> _______________________________________________
> Hipsec mailing list
> [email-masked]
> http://honor.trusecure.com/mailman/listinfo/hipsec
>=20

---

From: [email-masked] (Robert Moskowitz)
Date: Thu Nov 6 11:47:00 2003

At 11:55 AM 11/6/2003, Henderson, Thomas R wrote:
>happen.  You should only get R1 if you have sent I1.  If you
>send I1, you are by definition in state E1.  So we should not
>be processing R1 while in state E3.
>
>I would suggest:

Give me some time.  I will work out the attack model why I did this.

I spent a lot of time working out all the combinations.

> > Receive R1, send I2 but drop the incoming R2? Is there are
> > bug here or did
> > --

---

From: [email-masked] (Julien Laganier)
Date: Thu Nov 6 12:22:04 2003

On Thursday 06 November 2003 17:55, Henderson, Thomas R wrote:
> happen.  You should only get R1 if you have sent I1. 
>
> If you

Hi Tom,

The section "5.3 Reboot and SA timeout restart of HIP" says:
-----------------------
   If a system receives an ESP packet for an unknown SPI, the assumption
   is that it has lost the state and its peer did not. In this case, the
   system treats the ESP packet like an I1 packet and sends an R1
   packet.  The initiator HIT is typically NULL in the R1, since the
   system usually does not know the peer's HIT any more.

   The system receiving the R1 packet first checks to see if it has an
   established and recently used SA with the party sending the R1.  If
   such an SA exists, the system checks the Birthday, and if the
   Birthday is greater than the current SA's Birthday, it processes the
   R1 packet, optionally queuing the payload packet(s) to be resent
   later.  The peer system processes the I2 in the normal manner, and
   replies with an R2. This will re-establish state between the two
   peers.  Note that the process will result in new ESP SAs being used,
   and therefore simply resending ESP packets is not sufficient.
-----------------------

It seems that in this case you are in state E3, haven't send an I1, but 
receive an R1 (your correspondent lost his state).

And so you should reply with I2 after birthday check, and prepare to receive 
R2. If you can't receive R2 at this point (Like Bob Moskowitz told) then I 
guess that the whole scenario above doesn't work, unless we create another 
pending state (E5: resync pending ?)

Thoughts? Thanks,

--julien

-- 
"Memory is like gasoline. You use it up when you are running.
Of course you get it all back when you reboot..."; 
Explanation obtained from the Micro$oft help desk.
--
Julien Laganier 
SUN Microsystems Laboratories

***************************************************
    SunNetwork EMEA 2003 Conference and Pavilion
"Get Connected to the Future of Network Computing!"

        WHEN: December 3-4, 2003
        WHERE: ICC * Berlin, Germany

For more information or to register for the
conference, please visit http://sun.com/sunnetwork.
****************************************************

---

From: [email-masked] (Robert Moskowitz)
Date: Thu Nov 6 12:50:02 2003

I knew I worked through some of this.

You have to look at each state and what would happen if you receive any 
packet.  Otherwise you do not have a complete state machine.