Subject: [Ipsec] Re: New draft on hash use in IKE and IPsec

From: Michael Richardson <[email-masked]>
Date: Fri, 02 Dec 2005 12:36:51 -0500

>>>>> "Paul" == Paul Hoffman <[email-masked]> writes:
    Paul> I would greatly appreciate careful review of my assumptions both of
    Paul> where we use hash functions in our protocols and how they are used.

I read it.

Section 2.
a) IKEv2 uses hashes for authentication of the payloads.
           It is HMAC, so not a problem, but we should say so.

b) I think that I agree that the hash used in NAT-D is not
   susceptible. I'm not sure why. Reasons why it might not matter:

   i)  it's under the protection of the IKE SA, so it can't be modified
       by someone in the middle.

   ii) assuming that someone could find another set of IPs/ports which 
       hashed to the same value... what could they do?  At most they can
       turn NAT-T on or off my modifying the hash. That could lead to
       a failure to negotiate properly (won't move to port 4500, or moves
       incorrectly), but see (i).

   iii) the hash is not being used to provide integrity check of a larger
        object, but rather to obsecure the object. Maybe someone can 
        undo the hash to get the original values back. (The hash is bigger
        than the IPv4+port, but probably not bigger than the IPv6+port)

c) you say that an attacker could create two public keys with the same
   hash value. You say that this doesn't matter because the attacker would
   have to have both private keys.
   I don't understand this statement.
   
- -- 
]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson,    Xelerance Corporation, Ottawa, ON    |net architect[
] [email-masked]      http://www.sandelman.ottawa.on.ca/mcr/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Paul Hoffman <[email-masked]>
Date: Fri, 2 Dec 2005 10:36:51 -0800

>            It is HMAC, so not a problem, but we should say so.

Got it.

>        by someone in the middle.

That is it.

>    I don't understand this statement.

Is the following better? "This is not considered to be a useful 
attack in IKEv1 or IKEv2: the relying party views the attacker as the 
same entity because the identity is the same in both certificates."

--Paul Hoffman, Director
--VPN Consortium

---

From: Tero Kivinen <[email-masked]>
Date: Mon, 5 Dec 2005 15:13:07 +0200

>        by someone in the middle.

In IKEv2 they are protected, in the IKEv1 they are not protected. 

>         than the IPv4+port, but probably not bigger than the IPv6+port)

Yes, this is the reason why hashing is used in NAT-D. i.e. those
payloads are sent in clear, and some people were very concerned that
we reveal internal IP-addresses to the listeners outside the NAT, thus
we obscure them by hashing them. This does not offer very much
protection, but as random SPIs are included at least the listener
needs to do calculation for each connection separately, i.e.
precalculation is not possible. 
-- 
[email-masked]