Subject: [IPsec] Failure Detection - status of some issues

From: Yoav Nir <[email-masked]>
Date: Sun, 24 Oct 2010 10:55:41 +0200

#195 was closed as a duplicate of (the already closed) #191.
#193, #194, and #197 will be closed with the publishing of draft -02.

#202 (below) is newly submitted, and I expect a lively discussion of it in Beijing. It's fine to discuss it between now and then, as well as #198-#201, but if you have comments about #193, #194 and #197, please say them now, before we publish -02.

Token makers generating the same tokens without synchronized DB
=====================================================

Section 10.4 of the draft has a use-case where a cluster of gateways share the same QCD token secret, because they back each other up. 

The twist in this case, is that they don't have synchronized databases, so a fail-over is very much like a reboot - the IKE SA is gone, and QCD is effective in getting the other side to restart IKE quickly.

The problem is, that without a failover, it may be possible to get a member that does not own the IKE SA to send the QCD token to an attacker. The attacker can then use this QCD token to tear down the IKE SA.

The method in section 5.2 tries to address this, by considering the IP address of the token taker in the calculation. 

Tero claims that this is a scenario that we should not address, and that predicting or prescribing load balancer behavior in inherently dangerous.

---

From: Yaron Sheffer <[email-masked]>
Date: Sun, 24 Oct 2010 11:36:15 +0200

Two further problems with this solution are:

- We must have two different ways of producing the token, making 
security analysis more complex.

- The token taker does not know which method the maker is using, so it 
doesn't know whether it should request a new token each time it changes 
address (by piggybacking on the MOBIKE messaging). This is solved by 
allowing the maker to push the token, but at the cost of bandwidth and 
complexity.

Thanks,
	Yaron

On 10/24/2010 10:55 AM, Yoav Nir wrote:
> _______________________________________________
> IPsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipsec

---

From: Yoav Nir <[email-masked]>
Date: Sun, 24 Oct 2010 11:49:13 +0200

There is no "request". The maker can piggy-back on the MOBIKE response, and the taker has no way to request a token.

It gets more difficult when the taker changes address, and expects the maker to silently notice this and updates its SAs. I remember a discussion of this "cheap mobility" idea, but I don't remember if it was ever specified. In that case, the token maker will have to take the initiative.

On Oct 24, 2010, at 11:36 AM, Yaron Sheffer wrote:

> Scanned by Check Point Total Security Gateway.