Subject: [Hipsec] DH keymaterial regeneration during base exchange

From: [email-masked] (Henderson, Thomas R)
Date: Sun Jan 25 17:05:01 2004

> -----Original Message-----
> From: Miika Komu [mailto:[email-masked]]
> Sent: Friday, January 23, 2004 7:37 AM
> To: [email-masked]
> Subject: [Hipsec] DH keymaterial regeneration during base exchange
>=20
>=20
> Solution 1: Cache the DHa until it expires.
> - If DHb did not do the trick on the responder, fall back to using the
>   cached DHa if DHa has not expired (and deallocated).
> - The probability of fall backing to the cached DHa is quite minimal,
>   so it is difficult to use for DoS.
>=20
> Solution 2: modify the state machine
> - In UNASSOCIATED, the responder receives an I2 and encryption fails.
>   Resend R1 (with DHb) and don't change state.
> - In I2_SENT, the initiator receives R1, processes it, resends I2 and
>   stays in I2_SENT.
>=20
> These were just some coarse grained ideas, we haven't had=20
> time to think
> about this in more depth yet. Has anyone solved this problem already?
> Any ideas?

Caching DHa for a while seems reasonable, and requiring new cookies
to be generated when using a new DH, so that the cookie can be linked
to the DH that was in effect.

I'm wondering how vulnerable Solution 2 is to old R1 replay attacks,=20
getting initiator and responder to be repeatedly misaligned.

Tom