Subject: [Perc] Security hole in draft-ietf-perc-double-08?

From: "Alfred E. Heggestad" <[email-masked]>
Date: Fri, 16 Mar 2018 12:59:18 +0100

Hi,

I have some questions about this document:

     https://tools.ietf.org/html/draft-ietf-perc-double-08

I am currently implementing the Double SRTP encryption
part of PERC.

in my testcode I used by accident the same master key
for both the inner and outer transform. Then I discovered
that the doubly encrypted payload was EXACTLY THE SAME
as the plaintext payload (!).

is this how SRTP works, that encrypting it twice with the
same key gives back the original result ?

I have made a test program to demonstrate it:

     https://gist.github.com/alfredh/792759cccdd88d058bfd4a2a2d689922

running the program:

$ ./test
RTP packet:     [20 bytes]  80080001000000a05c5c5c5c0102030405060708
1xSRTP packet:  [36 bytes]  80080001000000a05c5c5c5c3b9c8bcd40a81c1f8946fd4b272f2aef98c50c18348ae92e
2xSRTP packet:  [53 bytes]  80080001000000a05c5c5c5c010203040506070865caa1e8cd9386bbc0e5cf5b1a3c5271eef5f5d6e444f15ff6bc5cdb4cf68859f3
                                                     ^^^^^^^^^^^^^^^^
program terminated successfully.

the first line shows the original plaintext RTP packet
(payload is 8 bytes 01..08)

the 3rd line prefixed with "2xSRTP" packet shows the SRTP packet
that will be transmitted on the wire. It also shows the
plaintext RTP packet (!)

again, note that exactly the same SRTP key was used for inner and outer,
this is not a normal usecase I assume.

But I wanted to give this info as input to the Working Group so
the experts can determine if it is a real problem or not.

Thanks,

Alfred

---

From: Harald Alvestrand <[email-masked]>
Date: Fri, 16 Mar 2018 12:02:58 +0000

I think this is the definition of symmetric encryption: The encryption
and decryption keys are the same.
This also means that if you encrypt twice, you get back the plaintext, yes.

On 03/16/2018 11:59 AM, Alfred E. Heggestad wrote:
> 1xSRTP packet:  [36 bytes] 
> 80080001000000a05c5c5c5c3b9c8bcd40a81c1f8946fd4b272f2aef98c50c18348ae92e
> 2xSRTP packet:  [53 bytes] 
> 80080001000000a05c5c5c5c010203040506070865caa1e8cd9386bbc0e5cf5b1a3c5271eef5f5d6e444f15ff6bc5cdb4cf68859f3
>                                                     ^^^^^^^^^^^^^^^^
> _______________________________________________
> Perc mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/perc

-- 
Surveillance is pervasive. Go Dark.

---

From: Richard Barnes <[email-masked]>
Date: Fri, 16 Mar 2018 08:14:09 -0400

Not the definition of symmetric encryption, but the definition of CTR mode,
on which GCM is based.  Basically, you make a keystream that you XOR with
the plaintext, so if you do that twice with the same nonce and key, you get
the plaintext back.

It would be good to explicitly prohibit this in the spec, though.  Alfred,
want to send a PR?

On Fri, Mar 16, 2018 at 8:02 AM, Harald Alvestrand <[email-masked]>
wrote:

> > 80080001000000a05c5c5c5c010203040506070865caa1e8cd9386bbc0e5
> cf5b1a3c5271eef5f5d6e444f15ff6bc5cdb4cf68859f3
> >                                                     ^^^^^^^^^^^^^^^^

---

From: Cullen Jennings <[email-masked]>
Date: Sat, 17 Mar 2018 19:13:45 +0000

I created a bug for this at https://github.com/ietf/perc-wg/issues/151

> On Mar 16, 2018, at 11:59 AM, Alfred E. Heggestad <[email-masked]> wrote:
> 
> Hi,
>