Subject: [Ipsec] Clarification on error notifications, please

From: [email-masked]
Date: Fri, 16 Sep 2005 11:15:29 -0400

It is not really clear to me what the scope of the following statement take
from the IKEv2 draft, chapter 2.21, is.

"A node receiving such an unprotected Notify payload MUST NOT respond and
MUST NOT change the state of any existing SAs."

My understanding is that this sentence only refers to the case where a node
receives a message outside of the context of an IKE SA as outlined in the
paragraph above this sentence, but not to the case where the node receives a
notification on an IKE SA that is not (yet) completely negotiated. In
particular, this sentence does not refer to an encrypted
AUTHENTICATION_FAILED notification sent after a successful INIT exchange,
although the notification will not be authenticated. (If this sentence were
referring to such notifications, they would be not very meaningful.)
Is my understanding correct?

Thanks,

Thomas G.

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Tero Kivinen <[email-masked]>
Date: Mon, 19 Sep 2005 03:39:42 +0300

[email-masked] writes:
> notification on an IKE SA that is not (yet) completely negotiated.

If the IKE SA is not finished, then it is not finished, thus we do not
have IKE SA ready, thus we cannot use the protection of the IKE SA to
send error messages.

> In particular, this sentence does not refer to an encrypted
> AUTHENTICATION_FAILED notification sent after a successful INIT
> exchange, although the notification will not be authenticated. (If
> this sentence were referring to such notifications, they would be
> not very meaningful.) Is my understanding correct?

We do not know if the INIT exchange was successfull before we actually
manage to verify the AUTH payload of the IKE_AUTH. Attacker can modify
IKE_SA_INIT message at will, and we only notice that when we verify
the AUTH payload. If we cannot verify the AUTH payload, that means
that either there is something wrong with authentication data (keying
material, certificates etc) or someone have modified the IKE_SA_INIT.

Just encrypting and mac'ing the packets with some diffie-hellman key
without authentication, does NOT give those messages any more
protection than clear text notifies have.

To get authenticated notify messages you need be able to parse and
check the AUTH payloads, so in the sense AUTHENTICATION_FAILED
notification can never be sent in a protected way.

After you get through the first IKE_AUTH exchange, then you have
authenticated IKE SA and you can send authenticated error messages,
but on the other hand you do not send AUTHENTICATION_FAILED after that
point (i.e. if you have EAP, you send EAP failure instead of
AUTHENTICATION_FAILED). 
-- 
[email-masked]