Subject: [MSEC] Regarding GDOI GM rekey "receive window"

From: "Lewis Chen (lewisc)" <[email-masked]>
Date: Fri, 22 Apr 2011 10:26:05 -0700

http://tools.ietf.org/html/draft-ietf-msec-gdoi-update-08

In Section 5.7 (Sequence Number Payload), it mentions the following:

"The current value of the sequence number
   must be transmitted to group members as a part of the Registration SA
   payload.  A group member must keep a sliding receive window.  The
   window must be treated as in the ESP protocol [RFC4303
<http://tools.ietf.org/html/rfc4303> ] Section
<http://tools.ietf.org/html/draft-ietf-msec-gdoi-update-08#section-> 
   3.4.3
<http://tools.ietf.org/html/draft-ietf-msec-gdoi-update-08#section-> ."

In GDOI, implementing a sliding receive window for group member (GM)  is
risky because the rekey message contains relative SA lifetimes in it.
Thus, GM accepting old rekey (due to the sliding receive window) may
install SAs that are no longer part of the group policy, or will be used
by the group member after the group policy changes.  Therefore,  group
member should only accept a rekey message with a sequence number value
larger than any previously received sequence number.

In fact, in Section 7.3.4(Replay/Reflection Attack Protection), it
describe the correct rekey acceptance criteria as below.

  " The GROUPKEY-PUSH message includes a monotonically increasing
   sequence number to protect against replay and reflection attacks.  A
   group member will discard sequence numbers associated with the
   current KEK SPI that have the same or lower value as the most
   recently received replay number."

Thanks,
Lewis

---

From: Brian Weis <[email-masked]>
Date: Wed, 27 Apr 2011 11:36:24 -0700

Hi Lewis,

Thanks for pointing this out ... in the absence of any objections we'll plan to fix this in the next version of the I-D.

Brian

On Apr 22, 2011, at 10:26 AM, Lewis Chen (lewisc) wrote:

> “The current value of the sequence number
>    window must be treated as in the ESP protocol [RFC4303] Section
>    3.4.3.”
>  
>  
> In GDOI, implementing a sliding receive window for group member (GM)  is risky because the rekey message contains relative SA lifetimes in it. Thus, GM accepting old rekey (due to the sliding receive window) may install SAs that are no longer part of the group policy, or will be used by the group member after the group policy changes.  Therefore,  group member should only accept a rekey message with a sequence number value larger than any previously received sequence number.
>  
>  
> In fact, in Section 7.3.4(Replay/Reflection Attack Protection), it describe the correct rekey acceptance criteria as below.
>  
>  
>   “ The GROUPKEY-PUSH message includes a monotonically increasing
>    recently received replay number.”
>  
>  
>  
> Thanks,
> Lewis
>  
> 
>  
>  
> _______________________________________________
> MSEC mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/msec

-- 
Brian Weis
Security Standards and Technology, SRTG, Cisco Systems
Telephone: +1 408 526 4796
Email: [email-masked]