Subject: [Simple] MSRP comments - security

From: Aki Niemi <[email-masked]>
Date: Tue, 21 Oct 2003 11:25:35 +0300

Hi,

A couple more things came to mind about MSRP security. There are 
multiple authentication mechanisms available (digest, TLS 
authentication), as well as potentially many digest algorithms available 
(SHA1, plus extensibility).

First of all, the security considerations should probably say something 
about authenticating with multiple mechanisms, and the vulnerabilities 
this might introduce. For example, TLS could be used to authenticate the 
server, and then digest could be used to authenticate the client after 
the TLS tunnel is established. There is potential for a MITM attack, if 
these same digest credentials are ever used without the TLS tunnel [1].

Secondly, the digest mechanism has extensibility for other digest 
algorithms, yet the SChal "algorithm" parameter is single valued. This 
is a problem, since the client has no way to indicate the server 
challenge contained an algorithm it does not support. Hence there needs 
to be a way to negotiate the used algorithm, e.g., by the server 
challenging with a list, and the client then picking one from that list.

Furthermore, if negotiation of the used algorithm isn't secure, there is 
a possibility for a bidding down attack.

So, my proposal is to modify the SChal so that the algorithm field is 
multi-valued, and this field is also included in the request-digest. The 
algorithm field in the CAuth then again needs to be single-valued, to 
indicate which algorithm was chosen by the client.

Regards,
Aki

[1] http://eprint.iacr.org/2002/163/

_______________________________________________
Simple mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/simple

---

From: Ben Campbell <[email-masked]>
Date: Tue, 21 Oct 2003 10:17:10 -0500

> these same digest credentials are ever used without the TLS tunnel [1].

I agree we could use a little more here. However, at this point anything 
like this will probably need to be listed as an open issue in the draft 
version I am currently trying to get out the door.

> challenging with a list, and the client then picking one from that list.

We made an explicit decision in Ottowa not to allow digest extensibility.

---

From: Ben Campbell <[email-masked]>
Date: Tue, 21 Oct 2003 10:17:10 -0500