Subject: Re: [MSEC] GDOI fix

From: Ran Canetti <[email-masked]>
Date: Wed, 19 Dec 2001 14:46:36 -0500

Hi Cathy,  Good catch!
These are indeed potentially bad attacks.

Fortunately, they are easy to thwart, as you noted in your mail:

>It also occurred to me, after following the discussion on IPSEC, that it
>would be possible to foil this attack by requiring POP signatures
>to be on the two nonces followed by some short non-random field.  Thus,
>POP_I could be over (N_i || N_r || 0 ) and POP_R could be over
>(N_i || N_r || 1), although we might want to use different integers
>besides 0 and 1, since those are the ones currently being used by JFK.
>If we don't want to put a limit on the nonce sizes for whatever reason,
>this could be preferable.

I agree - all that has to be done is when the GCKS signs a POP challenge, 
it should add to the signed text a reserved string that is interpreted as the
message "this is a signature on a POP challenge". 
This way, the POP signatures will be worthless as GROUPKEY-PUSH signatures
and the attacks will be thwarted.  I'd suggest though that:
-The special string will be prepended rahter than appended, to avoid
potential decoding ambiguities.
-The special string be a bit more distinctive, again to avoid mistakes.
How about, say, the string "POP" in ascii.

(A general lesson for us in protocol design: When using a signature in a
protocol, make sure to add a special string that ties the signature to its
particular use in the protocol.)

(A first place to implement the above lesson: Add a similar string also 
to the POP signature by the group member.)

Ran

_______________________________________________
msec mailing list
[email-masked]
http://www.pairlist.net/mailman/listinfo/msec