Subject: RE: [Mip4] dynamic keys

From: "Jeremy A. Greene" <[email-masked]>
Date: Wed, 11 Feb 2004 16:05:58 -0500

I was referring to the offline attacks. Where does it say in the mip-key
or diameter-aaa drafts that username/pw would only be used once?

>From section 5 of the mip-key draft:

1. Using the Key Generation Nonce from the extension, the mobile

       node calculates

          key = HMAC-MD5 (AAA-key, {Key Generation Nonce || home

          address})

...

The secret key used within the HMAC-MD5 computation is indicated by

   the AAA Security Association indexed by the AAA SPI, which has been

   previously configured as the basis for the AAA Security Association

   between the mobile node and the AAA server creating the key material.

If I understand what you're suggesting, the aaa-key above would be
generated from a username/password on the MN (and HA, somehow). But the
text above seems to imply it will be used every time the aaah sends a
new nonce to create new 'session' keys.

And I still think there's a practical issue of using passwords to create
a hash on the MN since the HA won't be able to verify it without the
password clear-text to run through the same hash.

Sorry if I'm being slow on this, but everything with security is way too
confusing!

Jeremy

-----Original Message-----
From: Henrik Levkowetz [mailto:[email-masked]] 
Sent: Wednesday, February 11, 2004 2:56 PM
To: Jeremy A. Greene
Cc: [email-masked]; [email-masked]
Subject: Re: [Mip4] dynamic keys

Jeremy,

Wednesday 11 February 2004, Jeremy A. Greene wrote:

> But, more importantly, there's a concern in the 802.11, wpa area that

> touches on this:

> http://wifinetnews.com/archives/002452.html 

No, there's no real similarity here.  The concern in this article is

that it uses a broken procedure to generate a temporary session key,

resulting in eavesdropping being possible, and goes on to discusses

offline attacks on the passphrase.  Offline attacks on an authenticating

password/username combination is not that relevant in a bootstrap

scenario where you only use a specific username/password combination

once, and any repeated use will be blocked.

      Henrik

---

From: Henrik Levkowetz <[email-masked]>
Date: Wed, 11 Feb 2004 22:24:51 +0100

Ok,

    I guess we may have talked past each other a little bit.

I was referring to your comments some mails back about the problems with
pre-shared keys being troublesome, and it being better if one could use
the more conventional username/password.  I intended to show that you
could use a username/password combination to bootstrap the process,
preferably by using the username/password once for authentication and
for protecting the transfer of a more long-term mn-aaah shared secret;
this in turn would be used as described in the aaa-key draft to
generate mn-ha keys.

Sorry if I was insufficiently clear about this.

	Henrik

---

From: Tom Hiller <[email-masked]>
Date: Wed, 11 Feb 2004 15:58:14 -0600

Jeremy,

I'd like to clarify a few things:

1) The MN-AAA shared secret is used more than once
2) It is periodically refreshed
3) It is configured per mobile and is not shared by other mobiles
4) aaa-keys does not say how the key is periodically refreshed.

I've acted as the editor, addressing security review comments and other 
comments from IETF and 3GPP2 folks.   Summary: (1) The MN-AAA secret had 
to be refreshed periodically.  That was added to the text.  (2) The term 
"security association" was overloaded; "mobility security association", 
etc., were added to the text.  There was an IANA assignment that did not 
match earlier text in the draft, and other editorial nits.  Those were 
fixed.

	- Tom

PS In an earlier email, I provided a link to an MN-AAA shared secret 
provisioning 3GPP2 specification that uses https.  A problem with 
provisioning in cdma2000 is that the mobile may not have an IP address 
at the time the provisioning server wishes to refresh the shared secret 
or other data, the phone may have just been purchased, etc., so there 
are radio network specific scenarios to be specified.

Jeremy A. Greene wrote:

> If I understand what you’re suggesting, the aaa-key above would be 
> new nonce to create new ‘session’ keys.
> 
>  
> 
> And I still think there’s a practical issue of using passwords to create 
> a hash on the MN since the HA won’t be able to verify it without the 
> Sorry if I’m being slow on this, but everything with security is way too 
> confusing!
> 
>  
> 
> Jeremy
> 
>  
> 

-- 
Mip4 mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mip4

---

From: Pete McCann <[email-masked]>
Date: Mon, 16 Feb 2004 16:55:20 -0600

I think it's also important that the MN-AAA secret be generated
according to sound random number principles ala RFC 1750.  If a plain
text password is used, it may be vulnerable to offline dictionary
attacks because all the other input parameters to the HMACs are
potentially public knowledge.

Note that making the MN-AAA out of a one-way function from a plain
text password is not good enough, because it just adds one additional
step to the dictionary attack.

-Pete

Tom Hiller writes:

 > I've acted as the editor, addressing security review comments and other=20
 > comments from IETF and 3GPP2 folks.   Summary: (1) The MN-AAA secret had=20
 > to be refreshed periodically.  That was added to the text.  (2) The term=20
 > "security association" was overloaded; "mobility security association",=20
 > etc., were added to the text.  There was an IANA assignment that did not=20
 > match earlier text in the draft, and other editorial nits.  Those were=20
 > fixed.
 > 
 > 
 > 	- Tom
 > 
 > PS In an earlier email, I provided a link to an MN-AAA shared secret=20
 > provisioning 3GPP2 specification that uses https.  A problem with=20
 > provisioning in cdma2000 is that the mobile may not have an IP address=20
 > at the time the provisioning server wishes to refresh the shared secret=20
 > or other data, the phone may have just been purchased, etc., so there=20

Jeremy A. Greene wrote:

> I was referring to the offline attacks. Where does it say in the mip-ke=
y=20
>=20
> =20
>=20
>=20
> =20
>=20
>=20
>=20
> =20
>=20
>           key =3D HMAC-MD5 (AAA-key, {Key Generation Nonce || home
>=20
>           address})
>=20
> ...
>=20
>=20
>=20
>=20
>=20
> =20
>=20
> If I understand what you=92re suggesting, the aaa-key above would be=20
> generated from a username/password on the MN (and HA, somehow). But the=
=20
> text above seems to imply it will be used every time the aaah sends a=20
> new nonce to create new =91session=92 keys.
>=20
> =20
>=20
> And I still think there=92s a practical issue of using passwords to cre=
ate=20
> a hash on the MN since the HA won=92t be able to verify it without the=20
>=20
> =20
>=20
> Sorry if I=92m being slow on this, but everything with security is way =
too=20
>=20
> =20
>=20
>=20
> =20
>=20
>=20
> =20
>=20
>=20
> =20
>=20
>=20
>=20
>=20
>=20
> =20
>=20
>=20
>=20
>=20
> offline attacks on the passphrase.  Offline attacks on an authenticatin=
g
>=20
>=20
>=20
>=20
> =20
>=20
>=20