Subject: FCIP and iFCP Keying Problem

From: [email-masked]
Date: Fri, 7 Sep 2001 16:33:58 -0400

Both FCIP and iFCP intend to require:

	- IKE with pre-shared keys MUST implement
	- IKE with public-key based keys MAY implement
	- IKE Main Mode MUST implement
	- IKE Aggressive Mode MAY implement

That's not acceptable because the result of combining
the two mandatory (MUST) mechanisms is vulnerable to a
man-in-the-middle attack.

If IKE with pre-shared keys is "MUST implement" (which
makes sense, as it's the simplest IKE authentication
mechanism), then:
	- IKE Aggressive Mode needs to be "MUST implement"
	- Use of IKE Main Mode with pre-shared keys needs
		to be "SHOULD NOT use" or "MUST NOT use".
Alternatively, if IKE Aggressive Mode remains "MAY implement",
then:
	- IKE with signature authentication based on public
		keys needs to be "MUST implement" along with
		some certificate usage guidelines.
	- Pre-Shared keys needs to be "MAY implement" (can't
		be any stronger than the requirement for
		IKE Aggressive Mode).
	- Use of IKE Main Mode with pre-shared keys needs
		to be "SHOULD not use" or "MUST not use".

Changing IKE to remove the Main Mode vulnerability
with pre-shared keys is not a viable approach.

Sorry,
--David

---------------------------------------------------
David L. Black, Senior Technologist
EMC Corporation, 42 South St., Hopkinton, MA  01748
+1 (508) 435-1000 x75140     FAX: +1 (508) 497-8500
[email-masked]       Mobile: +1 (978) 394-7754
---------------------------------------------------

---

From: [email-masked]
Date: Fri, 7 Sep 2001 18:28:03 -0400

Filling in a couple of missing pieces here:

- See Section 4.4 of draft-aboba-ips-iscsi-security-00.txt
	for more details on the man-in-the-middle vulnerability.
	That vulnerability is based on the use of group pre-shared
	keys.  
- My strong language below is based in part on an 
	assumption that banning group pre-shared keys is
	unworkable in practice.  Key management is a pain,
	and use of group pre-shared keys simplifies it, even
	though it has some security costs.

Questioning the latter assumption is reasonable, but I'll
point out that group pre-shared (vs. per session pre-shared)
keys are a fact of life in current IPsec deployment/management,
and even turn up in the absence of dynamic IP address
assignment.  The reason the text in my previous message
just said "pre-shared keys" rather than "group pre-shared keys"
is that there may be no way for a participant in an IKE
session to know whether the pre-shared key was shared only
among the two endpoints of the session or with other parties.

Thanks,
--David

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> Sent: Friday, September 07, 2001 4:34 PM
> To: [email-masked]
> Subject: FCIP and iFCP Keying Problem
> Importance: High
> 
>

---

From: "Franco Travostino" <[email-masked]>
Date: Fri, 07 Sep 2001 19:14:54 -0400

>man-in-the-middle attack.

Clarification:

I realize that in the (main mode, pre-shared key) variant the endpoints' 
identities can only be IP addresses due to a chicken-and-egg problem (and 
rfc2409 confirms this). I also realize that this variant is useless in the 
presence of DHCP-assigned IP addresses (which is not our case, as we only 
work with static IP addresses). A DH is obviously vulnerable to a MIM 
attack, but a DH + pre-shared key intuitively shouldn't. And I don't think 
we worry about identities being revealed. What am I missing? (rfc2409 has 
single-handedly neutralized the few brain cells that I've left).

-franco

Franco Travostino, Director Content Internetworking Lab
Advanced Technology Investments
Nortel Networks, Inc.
600 Technology Park
Billerica, MA 01821 USA
Tel: 978 288 7708 Fax: 978 288 4690
email: [email-masked]

---

From: [email-masked]
Date: Fri, 7 Sep 2001 19:06:20 -0400

Resending as I didn't see this come through - apologies
if it's a duplicate.  --David

> From: Black, David (MKT Hopkinton) 
> Sent: Friday, September 07, 2001 6:28 PM
> To: Black, David (MKT Hopkinton); [email-masked]
> Subject: RE: FCIP and iFCP Keying Problem
> 
>

---

From: [email-masked]
Date: Fri, 7 Sep 2001 19:07:57 -0400

> I realize that in the (main mode, pre-shared key) variant
> the endpoints' identities can only be IP addresses due to
> a chicken-and-egg problem (and rfc2409 confirms this).
> I also realize that this variant is useless in the presence
> of DHCP-assigned IP addresses (which is not our case, as
> we only work with static IP addresses).
 
I'm not sure I believe the parenthetical comment about only
working with static IP addresses.  I suspect a "MUST NOT use
DHCP-assigned IP addresses" restriction wouldn't make it
through the IESG.
 
> A DH is obviously vulnerable to a MIM attack, but a
> DH + pre-shared key intuitively shouldn't.
 
Suppose the MIM is part of the group that has the pre-shared key.
The MIM attack on DH is once again possible.
 
> And I don't think we worry about identities being revealed.
 
I agree, otherwise I wouldn't be suggesting Aggressive Mode
(which reveals identities) as a MUST.
 
--David

-----Original Message-----
From: Franco Travostino [mailto:[email-masked]]
Sent: Friday, September 07, 2001 7:15 PM
To: [email-masked]; [email-masked]
Subject: Re: FCIP and iFCP Keying Problem

Clarification:

-franco

---

From: Robert Snively <[email-masked]>
Date: Fri, 7 Sep 2001 15:20:27 -0700

David,

Could you please give us a short tutorial or reference
explaining this weakness for us beginners in security?

Many thanks,

Bob Snively

> man-in-the-middle attack.

-----
Message-ID: <277DD60FB639D511AC0400B0D068B71ECAD71A@CORPMX14>
From: [email-masked]
To: [email-masked]
Subject: FCIP and iFCP Keying Problem
Date: Fri, 7 Sep 2001 13:33:58 -0700 
Importance: high
X-Priority: 1
X-Mailer: Internet Mail Service (5.5.2653.19)

Sorry,
--David

---

From: Venkat Rangan <[email-masked]>
Date: Sat, 8 Sep 2001 15:42:13 -0700

Although the issue of revealing identity is not significant (which means
Aggressive Mode + pre-shared) keys is okay for an FCIP tunnel
implementation, the question is whether many current IPsec gateways support
Aggressive Mode. It only carries a "SHOULD implement" mandate in RFC2409. It
would appear that the issues of DHCP assigned addresses and its usability in
conjunction with Main Mode + pre-shared keys would be more severe in
l2tp/vpn solutions, and this would force gateways to implement Aggressive
Mode; but can we depend on its availability.
 
As Franco states for iFCP, it is not clear that FCIP endpoint addresses will
be handed out using DHCP. In fact, some of this will be made available using
SLPv2 DAs and SAs, so they are fairly static. (This opens up the issue of
SLPv2 itself having to be performed after IKE Phase-1 is done.)
 
Would the problem be less severe if the FCIP Endpoint WWN is sent as IKE
payload in conjunction with Main-mode+pre-shared key?
 
Is it also not the case that Aggressive Mode with public key encryption
still prevents identities being revealed?
 
Venkat Rangan
Rhapsody Networks Inc.
http://www.rhapsodynetworks.com <http://www.rhapsodynetworks.com> 

 -----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Friday, September 07, 2001 4:08 PM
To: [email-masked]; [email-masked]
Subject: RE: FCIP and iFCP Keying Problem

 

 
 
--David

-----Original Message-----
From: Franco Travostino [mailto:[email-masked]]
Sent: Friday, September 07, 2001 7:15 PM
To: [email-masked]; [email-masked]
Subject: Re: FCIP and iFCP Keying Problem

Clarification:

-franco

---

From: Sandeep Joshi <[email-masked]>
Date: Mon, 10 Sep 2001 11:03:19 -0400

About aggressive mode support in IKE..
   See   http://www.vpnc.org/features-chart.html
Most vendors appear to support it.

In addition to the above, KAME(*BSD) and isakmpd support
it as well.  But Win2000 and FreeS/WAN(Linux) do not
support aggressive mode (and FreeS/WAN may never...)
Although perhaps not relevant to FCIP/iFCP, the latter
may have implications on iSCSI end-systems

-Sandeep

> Although the issue of revealing identity is not significant
> (which means Aggressive Mode + pre-shared) keys is okay for
> an FCIP tunnel implementation, the question is whether many
> current IPsec gateways support Aggressive Mode. It only
> carries a "SHOULD implement" mandate in RFC2409.  It would
> appear that the issues of DHCP assigned addresses and its
> usability in conjunction with Main Mode + pre-shared keys
> would be more severe in l2tp/vpn solutions, and this would
> force gateways to implement Aggressive Mode; but can we
> depend on its availability.
>
> As Franco states for iFCP, it is not clear that FCIP endpoint
> addresses will be handed out using DHCP.  In fact, some of
> this will be made available using SLPv2 DAs and SAs, so they
> are fairly static. (This opens up the issue of SLPv2 itself
> having to be performed after IKE Phase-1 is done.)
>
>      Would the problem be less severe if the FCIP Endpoint WWN
> is sent as IKE payload in conjunction with Main-mode+pre-shared key?
>
>      Is it also not the case that Aggressive Mode with public
> key encryption still prevents identities being revealed?
>
>      Venkat Rangan
>      Rhapsody Networks Inc.
>      http://www.rhapsodynetworks.com
>