Subject: [Ipsec] Replicated identities across multiple remote access users

From: Surya Batchu <[email-masked]>
Date: Sun, 23 Jan 2005 14:15:05 -0800 (PST)

In IPsec drafts and standards, there is no explicit prohition of reusing the identity by remote access clients. It seems to me that, there was an implicit understanding that each peer uses its own and unique identity. Now, we have a need to support multiple remote access sessions using the same identitiy. Some of the issues I can see are with INITIAL-CONTACT and assignment of internal IP address (virtual IP address) to the clients.
 
What are the other technical&deployment issues in allowing duplicate identities from IKE based remote access clients?
 
Surya

---------------------------------
Do you Yahoo!?
 Yahoo! Search presents - Jib Jab's 'Second Term'

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Thor Lancelot Simon <[email-masked]>
Date: Sun, 23 Jan 2005 19:48:58 -0500

On Sun, Jan 23, 2005 at 02:15:05PM -0800, Surya Batchu wrote:
>
> In IPsec drafts and standards, there is no explicit prohition of
> reusing the identity by remote access clients. It seems to me that,
> there was an implicit understanding that each peer uses its own and
> unique identity. Now, we have a need to support multiple remote access
> sessions using the same identitiy.

That's a spectacularly bad idea.  It makes possible an array of man in
the middle and credential-stealing attacks that are remarkably easy to
execute.  You almost might as well not use IPsec at all.

-- 
 Thor Lancelot Simon	                                      [email-masked]

"The inconsistency is startling, though admittedly, if consistency is to be
 abandoned or transcended, there is no problem."		- Noam Chomsky

---

From: Paul Koning <[email-masked]>
Date: Mon, 24 Jan 2005 10:16:54 -0500

>>>>> "Thor" == Thor Lancelot Simon <[email-masked]> writes:

 Thor> On Sun, Jan 23, 2005 at 02:15:05PM -0800, Surya Batchu wrote:
 >> reusing the identity by remote access clients. It seems to me
 >> that, there was an implicit understanding that each peer uses its
 >> own and unique identity. Now, we have a need to support multiple
 >> remote access sessions using the same identitiy.

 Thor> That's a spectacularly bad idea.  It makes possible an array of
 Thor> man in the middle and credential-stealing attacks that are
 Thor> remarkably easy to execute.  You almost might as well not use
 Thor> IPsec at all.

I'd say that's a bit of an exaggeration.

It seems to me that a remote access server has to support multiple
sessions with the same identity, because the same user may want to
establish multiple sessions.  That's a perfectly good application
without serious security issues.

On the other hand, I would agree that it makes sense to warn that
identities should not be shared among multiple users, because then
each can impersonate the other.  But that's an administrative
guideline, not a rule that translates into server algorithms.

	   paul

---

From: "Geoffrey Huang" <[email-masked]>
Date: Mon, 24 Jan 2005 09:08:05 -0800

Michael Richardson did a particularly good job summarizing a discussion the
ICSA had about this very subject:

http://www1.ietf.org/mail-archive/web/ipsec/current/msg01032.html

-g

________________________________

	From: [email-masked] [mailto:[email-masked]] On
Behalf Of Surya Batchu
	Sent: Sunday, January 23, 2005 2:15 PM
	To: [email-masked]
	Subject: [Ipsec] Replicated identities across multiple remote access
users

	In IPsec drafts and standards, there is no explicit prohition of
reusing the identity by remote access clients. It seems to me that, there
was an implicit understanding that each peer uses its own and unique
identity. Now, we have a need to support multiple remote access sessions
using the same identitiy. Some of the issues I can see are with
INITIAL-CONTACT and assignment of internal IP address (virtual IP address)
to the clients.
	 
	What are the other technical&deployment issues in allowing duplicate
identities from IKE based remote access clients?
	 
	Surya

	________________________________

	Do you Yahoo!?
	Yahoo! Search presents - Jib Jab's 'Second Term'
<http://us.rd.yahoo.com/evt=30648/*http://movies.yahoo.com/movies/feature/ji
bjabinaugural.html>