Subject: Re: [Mobike] New issue 18: Threat discussion

From: Jari Arkko <[email-masked]>
Date: Mon, 11 Oct 2004 14:19:06 +0300

I think we concluded in this threat that your original
list of four threats should become three, by merging
threats 1 and 3.

Francis made the point that the level of authentication
makes a difference. Mohan made the point that there's
a difference between packet modification (on-path) vs.
independent (off-path) attacks. Atul asked about the
need for more general protection of the threat 1 than
what can be done in MOBIKE; I think we concluded that
AH or something similar is sufficient for other protocols
but people wanted MOBIKE to provide security against
the attack.

Taking this all into account, I think we have:

   1) Unauthenticated attacker directs the traffic stream
      from B to a third party C, with the intent flooding C
      with unwanted traffic. The attacker can be either on-path
      or off-path. The latter is of course more serious, but
      easier defended attack.

   2) Authenticated peer A directs the traffic stream from B
      to a third party C, with the intent of flooding C with
      unwanted traffic. The "authenticated peer" is the one
      that performed the initial IKE authentication. A
      request to update an address could be either unauthenticated,
      authenticated but leaving the actual address vulnerable
      for MITM modification. The validity of the new address
      could either be implied by the request or be independently
      verified; this verification could again require either
      no authentication at all, full authentication, or
      participation of the authenticated peer but leaving the
      address part unprotected.

   3) Unauthenticated attacker causes the IKE_SA to be
      closed by modifying just one or two IKE packets (if
      attacker can modify all packets, he can of course DoS).

--Jari
_______________________________________________
Mobike mailing list
[email-masked]
https://www.machshav.com/mailman/listinfo.cgi/mobike

---

From: Francis Dupont <[email-masked]>
Date: Mon, 11 Oct 2004 20:46:08 +0200

In your previous mail you wrote:

=> I have a concern with this because it is not a MOBIKE threat
but an IKE one. I propose to rewrite it, adding for example
that MOBIKE should not add a new vulnerability (i.e., MOBIKE
should be as resillient as IKE, BTW this should be easy to do).

Thanks

[email-masked]
_______________________________________________
Mobike mailing list
[email-masked]
https://www.machshav.com/mailman/listinfo.cgi/mobike

---

From: Jari Arkko <[email-masked]>
Date: Mon, 11 Oct 2004 22:00:19 +0300

> should be as resillient as IKE, BTW this should be easy to do).

Ok. Do you have suggested text?

--Jari

---

From: Francis Dupont <[email-masked]>
Date: Tue, 12 Oct 2004 17:02:01 +0200

=> I have a simpler (simplest :-) proposal: this attack doesn't work
because an unauthenticated attacker cannot produce valid IKE messages
after the IKE_SA_INIT exchange, i.e., only a brute force DoS can cause
the IKE_SA to be closed.

Thanks

PS: the key word is "unauthenticated".
_______________________________________________
Mobike mailing list
[email-masked]
https://www.machshav.com/mailman/listinfo.cgi/mobike