Subject: [Isms] RE: TLA

From: "Khanh Nguyen \(khanhvn\)" <[email-masked]>
Date: Mon, 2 May 2005 14:35:31 -0700

> -----Original Message-----
> From: Tom Petch [mailto:[email-masked]] 
> To: Khanh Nguyen (khanhvn); [email-masked]
> 
> mmm there's something about Three Letter Acronyms at the back of my
mind.
> I probably shouldn't be asking - since we are in the security area -
but
> 
> PSK is Pre-Shared Key - yes?

Yes.  PSK is often used for encryption (e.g. IPsec, Radius, etc), 
but it can also be used for multual authentication and generating
dynamic session keys for encryption.  For example:

http://www.ietf.org/internet-drafts/draft-ietf-tls-psk-08.txt

> PFS is what concept; perhaps you can point me at a seminal 
> article on it or a reference in a standard text.  (I may know 
> it under another name).

Brief definition of perfect forward secrecy:
http://www.mpirical.com/companion/IP/PFS_-_Perfect_Forward_Secrecy.htm

Basically, it's a desirable property of a cryptography system that
if any short/long-term secret is compromised, past encryption
is still protected.

USM breaks PFS by using the same privKey for all SNMP messages.
A hacker can silently tape all USM encrypted conversations, wait 
until a day when he can steal a SNMP device and retrieves the 
privKeys from it, then he can decrypt all the past communication 
he have taped.  The operator can never feel secure, because the 
fact that a session is secure now will not guarantee that it'll 
continue to be so in the future (that's why it's call "forward"
secrecy.)

TLS is an example of PFS.  If an attacker gains additional 
knowledge of a system secret in the future, he can not use 
it to break past communication. 

Sorry for the lengthy explanation, but I couldn't find any good 
online seminal article about it.  Many cryptography books may 
have in-deep discussion about PFS.  Maybe someone can provide
more info.

Khanh

> 
> Tom Petch
> 
> ----- Original Message -----
> From: "Khanh Nguyen (khanhvn)" <[email-masked]>
> To: "Tom Petch" <[email-masked]>; <[email-masked]>
> Sent: Monday, May 02, 2005 9:00 PM
> Subject: RE: [Isms] SNMPv3 security; the fundamental flaw?
> 
> 
> > From: Tom Petch
> >
> > My thinking ... is of a basic level consisting of a shared 
> secret with 
> > the security server (not with the SNMP manager-server) 
> which is then 
> > used to generate session keys for a small fixed set of 
> userids; not as 
> > secure as USM but much more secure than some systems I see. 
>  This can 
> > be a one touch solution; the secret can be randomised by 
> engine id (as 
> > Khanh suggested), to vary with box type (switch, router,
> > firewall) etc.
> 
> For proper credit, key localization is not my new idea :) I 
> borrowed the concept from USM.
> 
> The problem with USM is that it uses the localized authKey 
> and privKey statically: the same keys are used again and 
> again for all messages.  This breaks perfect forward secrecy (PFS).
> 
> This is not really USM fault (it has a smart design).  Its 
> lack of PFS and replay attack protection is rather an 
> inherent problem with any sessionless secure transport.  All 
> ISMS proposals we have seen here solve that problem 
> (conciously or not) by using some sorts of sessions/connections.
> 
> Back to localization, my LPSK proposal retains that USM 
> concept, but instead of using the localized secrets 
> statically, the secrets are used in conjuction with a secure 
> PSK auth protocol such as SRP to (1) authenticate *both* the 
> user/manager and the agent, and
> (2) generate a dynamic key for encryp & data integrity session.
> LPSK can be used in all 3 keying environments: OOBK (e.g. 
> EAP-SRP, SASL-SRP), IBK (SNMP implementation of SRP, which is 
> quite simple), and EK (TLS-SRP, etc.)
> 
> SRP (http://srp.stanford.edu) is just one of many PSK methods 
> that can be used to implement LPSK.  I picked it as an 
> example because it's secure, relatively simple, and widely used.
> 
> Khanh
> 

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "Randy Presuhn" <[email-masked]>
Date: Mon, 2 May 2005 14:59:17 -0700

Hi -

> Sent: Monday, May 02, 2005 2:35 PM
> Subject: [Isms] RE: TLA
...
> USM breaks PFS by using the same privKey for all SNMP messages.
...

No, the issue is how key changes work.

With USM, cracking a key (by whatever means) allows decryption of
all messages encrypted with that key.  This is true of *any* system.

Due to the way USM key updates work, cracking a USM key does
not help the attacker figure out what key was used prior to the cracked
key, unless the key update was done in the clear.  What some folks
would like, and what USM does *not* provide (unless one uses
RFC 2786) is the ability to prevent cracking a key from helping an
attacker figure out a key used *after* the cracked one.

Randy