Subject: RE: [Ipsec] Clarification on error notifications, please

From: [email-masked]
Date: Mon, 19 Sep 2005 13:36:04 -0400

Once we have obtained privacy and integrity protection, but not yet
authenticated our peer, we can break down the analysis into precisely two
cases:

a. we are talking with the intended peer

b. we are not talking with the intended peer (includes all man-in-the-middle
scenarios)

In case a. it is safe to respond to an AUTHENTICATION_FAILED notification by
tearing down our local state because we trust the message was generated by
the intended peer.

In case b it is safe to respond to an AUTHENTICATION_FAILED notification by
tearing down our local state because we never want to interact with an
incorrect peer.

We cannot know whether we are dealing with case a or b, but since tearing
down local state is safe and desirable in both cases, I think it is a
defensible approach.

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Tero Kivinen <[email-masked]>
Date: Mon, 19 Sep 2005 23:25:58 +0300

> b. we are not talking with the intended peer (includes all man-in-the-middle

c. We are talking to the intended peer, but attacker has modified the
cipher/prf/hash etc algorithms proposed by the initiator. 

> tearing down our local state because we never want to interact with an

And do we want to tear down the SA as attacker modified the cipher to
be null in IKE SA level, and we are now sending all that error
information in clear?

Note, that we haven't yet verified that the SA payload cipher/hash/prf
etc exchange is done properly without someone attacking against those.

-- 
[email-masked]