Subject: RE: problem with message integrity of KDC-REP messages

From: "Medvinsky, Sasha (SD-EX)" <[email-masked]>
Date: Wed, 21 Feb 2001 19:56:52 -0500

Comments in-line.

> -----Original Message-----
> From: Ken Raeburn [mailto:[email-masked]]
> Sent: Wednesday, February 21, 2001 3:02 PM
> To: Medvinsky, Sasha (SD-EX)
> Cc: [email-masked]'; [email-masked]'; Cliff Neuman (E-mail);
> [email-masked]'
> Subject: Re: problem with message integrity of KDC-REP messages
> 
> 
> (If we want to prevent with malicious attacks that could cause denials
> of service, we've got a *lot* of work to do....)

[sasha] I am not proposing that we prevent denial of service attacks in
general.  In this particular case, the client doesn't even know that it has
a bad ticket and doesn't know how to properly recover.  Just because we
can't prevent all types of denial of service doesn't mean that we shouldn't
prevent any.

> 
> "Medvinsky, Sasha (SD-EX)" <[email-masked]> writes:
> > As a result, due to malicious manipulation of KDC-REP 
> messages the client
> > might receive bad tickets and never find out that they are 
> bad, not knowing
> > enough to go back to the KDC and try to get a valid ticket. 
>  Within the
> > context of PacketCable (VoIP specification that utilizes 
> Kerberos), a client
> > does not accept unauthenticated error messages from an 
> application server -
> > so it will not see even the "bad message integrity" error.  
> 
> And if the bad message integrity error is caused by some other bug --
> perhaps a KDC bug, perhaps a MITM between client and server, maybe a
> server or KDC configuration error -- do you have the client just keep
> retrying until it times out?

[sasha] I don't know what MITM is, but I don't see why we would address the
case of a KDC bug.  To fix that kind of denial of service - just fix the KDC
code.  In this particular case, an attacker modifies only one message (e.g.
TGS Reply) and the result is that a client doesn't get access to a service
until the bad ticket expires - I find this to be a problem.

---

From: Ken Raeburn <[email-masked]>
Date: 22 Feb 2001 08:48:13 -0500

> can't prevent all types of denial of service doesn't mean that we shouldn't

Oh, I definitely agree.  I was just thinking that we need to carefully
define the class of problems we want to fix.  Allowing a MITM to feed
data to the client that the client will think valid but the server
will reject would be one such class, but I'm not certain that the
KDC-REP case is the only such one.  (Though no other interesting cases
come to mind offhand.)

> [sasha] I don't know what MITM is, but I don't see why we would address the

"man in the middle"

> until the bad ticket expires - I find this to be a problem.

I'm just thinking, should anything break, are you going to flood the
server with traffic it can't accept?  For example, if server key
management is done as poorly as I've seen ISPs do DHCP management,
clients may have tickets using keys deleted from the server.

Ken