Subject: Re: [MSEC] GDOI fix

From: "Catherine A. Meadows" <[email-masked]>
Date: Wed, 19 Dec 2001 20:38:38 -0500 (EST)

Brian:

I think that either appending or prepending would work.  However, Ran
had some concerns about decoding ambiguities if it was appended.  I'm not
sure what his concerns were, so I will let him answer on that.  It seems
to me that if you append special strings to both groupkey push
messages and POP's you would avoid this problem, but I would want to let
him speak for himself.

As to your solution, I think that it should work.  The only possible
drawback that I see is that if an optional CERT is included, and the
CERT itself ends in random data (unlikely but possible, and out
of our control) than the attack
is still possible.  I think that what we want to avoid here is the case
where one of the signed messages begins in random data, and the other
ends in random data.  Once we do that, we can avoid both spoofing attacks.

In my case, I wasn't suggesting prepending the "push" string to the message as
it is sent, but prepending the "push" to what is signed by the 
GCKS.  Thus the GROUPKEY-PUSH message
would look like

HDR* SEQ, KD, [CERT], SIG

where SIG is the result of signing a hash of
"push", HDR, SEQ, KD, [CERT]

I'd originally had your concerns about changing the syntax of HDR,
which is why I hadn't suggested prepending before, but if you just
prepend to what is signed, without including the prepended string
to the message as it is sent, it seems to me that you avoid this problem.
What is everyone's thoughts on this?

Cathy 

_______________________________________________
msec mailing list
[email-masked]
http://www.pairlist.net/mailman/listinfo/msec