Subject: Re: [MSEC] GDOI fix

From: "Catherine A. Meadows" <[email-masked]>
Date: Wed, 19 Dec 2001 15:14:55 -0500 (EST)

Ran:

Thanks!  It wasn't my catch, though, but the NRL Protocol Analyzer's.

I agree, prepending a special string to the POP challenge when it
is signed by the GCKS or by the SPI would work, but only if a different
special string (such as "push") was prepended to the GROUPKEY-PUSH
message when it is signed by the GCKS.  That is because the
signed part of the GROUPKEY-PUSH message is HDR, SEQ, KD,
and HDR begins in a random number, the SPI, which is supplied
by the GCKS.  So all a bad guy would have to do to get the GCKS
to sign a forged GROUPKEY-PUSH message would be to send it an Ni
of the form HDR, SEQ, KD', where HDR begins in a SPI of the
form "pop" || random stuff.  The group member who verifies the signature
presumably is just going to accept that the SPI is random, without
chcking that it begins with "pop".  If we have the GCKS sign
"push", HDR, SEQ, KD instead, that will prevent that.

All in all, I think I like the idea of prepending special fields to all
signed messages the
best.  It's easy for the verifier to check for, and if for some reason
it's necessary to add new signed messages to GDOI, it's easy to prepend
special strings to them too without having to worry about whether or not
what you're doing  breaks the defenses against this sort of attack
that you'd already built into the protocol.

Cathy

_______________________________________________
msec mailing list
[email-masked]
http://www.pairlist.net/mailman/listinfo/msec