Subject: Re: [sipcore] RFC4028 : bug in 11 Security Considerations (once again)

From: OKUMURA Shinji <[email-masked]>
Date: Wed, 1 Jul 2020 17:40:21 +0900

Roman,

I first suggested how the UAC would use the maximum value of MSE. How the UA knows the maximum MSE is the next topic.
At least a caller UA knows its own MSE. And the UA may receive a session refresh request, even if it is refresher. However it is a passive event, it doesn't happen for sure.

Q. How does a UA know the correct maximum value of the Min-SE?

A1. When a dialog is established, both UAs send a session refresh request with its own Min-SE. However, regulations are needed to prevent them from sending at the same time.

A2. When a dialog is established, either UA sends a session refresh request with its own Min-SE. And the UAS return Min-SE in 2xx.

In either case, UA may receive 422 responses, but only once.

Regards,
Shinji

On 2020/07/01 2:22, Roman Shpount wrote:
> How does UAC know the maximum value of the Min-SE?
> 
> If we require UAS return Min-SE in 2XX and for proxies to verify that Min-SE is equal or higher then the value they have set, then it would be possible to enforce this rule. Otherwise, the value Min-SE set by the proxy and ignored by UAS would only be known to the proxy.
> _____________
> Roman Shpount
> 
> 
> On Tue, Jun 30, 2020 at 5:30 AM OKUMURA Shinji <[email-masked] <mailto:[email-masked]>> wrote:
> 
>     Since the subject and the discussion have diverged, I will sort out the topic once again.
> 
>     The issue I raised:
> 
>     11.  Security Considerations
>          Next, consider the case of a rogue UAS that wishes to force a UAC to
>          generate refreshes at a rapid rate.  In that case, the UAC has to
>          support session timer.  The initial INVITE arrives at the rogue UAS,
>          which returns a 2xx with a very small session interval.  The UAC uses
>          this timer and quickly sends a refresh.  Section 7.4 requires that
>          the UAC copy the current session interval into the Session-Expires
>          header field in the request.  This enables the proxies to see the
>          current value.  The proxies will reject this request and provide a
>          Min-SE with a higher minimum, which the UAC will then use.  Note,
>          that if the proxies did not reject the request, but rather proxied
>          the request with a Min-SE header field, an attack would still be
>          possible.  The UAS could discard this header field in a 2xx response
>          and force the UAC to continue to generate rapid requests.
> 
>     If the rogue UAS returns again a 2xx with a very small session interval, the attack will continue.
> 
>     My suggestion:
>     The UAC compares the SE-value in 2xx response with the maximum value of the Min-SE. If the SE-value is less than the maximum MSE-value, then the UAC should consider the SE-value as the maximum MSE-value.
> 
>     Other suggestion:
>     The UAC should immediately terminate a call.
> 
>     How is it?
> 
>     Regards,
>     Shinji
> 
>     _______________________________________________
>     sipcore mailing list
>     [email-masked] <mailto:[email-masked]>
>     https://www.ietf.org/mailman/listinfo/sipcore
>

---

From: Roman Shpount <[email-masked]>
Date: Thu, 2 Jul 2020 13:19:46 -0400

Shinji,

I am going to ask, once again, is this a problem which affects anybody?

I would still argue that this is not a real security problem and should be
left as is.
_____________
Roman Shpount

On Wed, Jul 1, 2020 at 4:40 AM OKUMURA Shinji <[email-masked]> wrote:

> Roman,
>
> I first suggested how the UAC would use the maximum value of MSE. How the
> UA knows the maximum MSE is the next topic.
> At least a caller UA knows its own MSE. And the UA may receive a session
> refresh request, even if it is refresher. However it is a passive event, it
> doesn't happen for sure.
>
> A1. When a dialog is established, both UAs send a session refresh request
> with its own Min-SE. However, regulations are needed to prevent them from
> sending at the same time.
>
> A2. When a dialog is established, either UA sends a session refresh
> request with its own Min-SE. And the UAS return Min-SE in 2xx.
>
> > If we require UAS return Min-SE in 2XX and for proxies to verify that
> Min-SE is equal or higher then the value they have set, then it would be
> possible to enforce this rule. Otherwise, the value Min-SE set by the proxy
> and ignored by UAS would only be known to the proxy.
> > _____________
> > Roman Shpount
> >
> >
> >     The UAC compares the SE-value in 2xx response with the maximum value
> of the Min-SE. If the SE-value is less than the maximum MSE-value, then the
> UAC should consider the SE-value as the maximum MSE-value.
> >
> >     Other suggestion:

---

From: OKUMURA Shinji <[email-masked]>
Date: Fri, 3 Jul 2020 10:41:49 +0900

Roman,

This problem was originally listed in RFC4028. I am proposing an amendment because I believe the solution described in the RFC is inadequate.
Are you thinking that my claim that the RFC-listed solution is inadequate is wrong? Or are you arguing that it's inadequate but not necessary to fix it?

Regards,
Shinji

On 2020/07/03 2:19, Roman Shpount wrote:
> I would still argue that this is not a real security problem and should be left as is.

---

From: Roman Shpount <[email-masked]>
Date: Mon, 6 Jul 2020 19:14:58 -0400

I am arguing that the solution described is inadequate but it is not
necessary to fix it, since the actual problem (overloading proxies or
clients via session refresh) does not exist.
_____________
Roman Shpount

On Thu, Jul 2, 2020 at 9:41 PM OKUMURA Shinji <[email-masked]> wrote:

> Roman,
>
> This problem was originally listed in RFC4028. I am proposing an amendment
> because I believe the solution described in the RFC is inadequate.
> Are you thinking that my claim that the RFC-listed solution is inadequate
> is wrong? Or are you arguing that it's inadequate but not necessary to fix
> it?
>
> Regards,
> Shinji
>