Subject: [MSEC] Mikey Question

From: "Steffen Fries" <[email-masked]>
Date: Wed, 05 May 2004 11:42:29 +0200

Hi Elisabetta,

I've got (again ;-)) a question regarding MIKEY. 

Within the DH option, Mikey requires the responder of a MIKEY 
message to reflect the senders DH set. 

What is the reasonning for this requirement?

We were thinking about possible reasons. One was to the have the 
association between the message sent and the one received. The  
initiator is able to assign the response message to the message 
he originally send because of the timestamp. So we think that 
this may not be the reason. 

Do you have any comments.

Regards
	Steffen

_______________________________________________
msec mailing list
[email-masked]
http://www.pairlist.net/mailman/listinfo/msec

---

From: "Elisabetta Carrara (KI/EAB)" <[email-masked]>
Date: Mon, 10 May 2004 08:41:49 +0200

Hi Steffen, 
the messages in the two directions are essentially independent
if you don't include the original message in the response.

In *general*, authentication and key exchange protocols that
have this property are potentially subject to interleaving attacks
and cannot provide "key confirmation" (that the responder
will be able to deduce the correct key).

Now, even if for some reason (e.g. threat model, physical,
implict confirmation, etc) these issues are not considered 
problems, it is prudent to apply "best practice". 
In particular, we did not consider the quite low entropy 
source of the timestamp to be sufficient.

More discussion can be found in the Handbook of Applied 
Cryptography (Ch 10 and 12).

Cheers
/E

> -----Original Message-----
> From: Steffen Fries [mailto:[email-masked]]
> Sent: den 5 maj 2004 11:42
> To: Elisabetta Carrara (KI/EAB)
> Cc: [email-masked]; [email-masked]
> Subject: Mikey Question
> 
> 
> Hi Elisabetta,
>