Subject: RE: [Mipshop] AW: [Mobopts] Presentation slides for "CXTP using GIST"

From: "COMBES Jean-Michel RD-MAPS-ISS" <[email-masked]>
Date: Wed, 23 Nov 2005 17:19:31 +0100

Hi,

What are the reasons of such a compromise?

Cheers.

JMC.

France Telecom - R&D Division - MAPS/NSS   
Jean-Michel COMBES, Internet/Intranet Security
E-Mail: [email-masked]
Phone: +33 (0)1 45 29 45 94
Fax: +33 (0)1 45 29 65 19
Mobile: +33 (0)6 07 29 30 16 

> -----Original Message-----
> From: James Kempf [mailto:[email-masked]] 
> Sent: Wednesday, November 23, 2005 5:07 PM
> To: COMBES Jean-Michel RD-MAPS-ISS; Tschofenig, Hannes; DENG, 
> HUI -HCHBJ; Xiaoming Fu; [email-masked]; [email-masked]
> Cc: Xiaoming Fu
> Subject: Re: [Mipshop] AW: [Mobopts] Presentation slides for 
> "CXTP using GIST"
> 
> Section 4:
> 
>       Prevent the Domino effect
> 
>          Compromise of a single peer MUST NOT compromise 
> keying material
>          held by any other peer within the system, including session
>          keys and long-term keys.  Likewise, compromise of a single
>          authenticator MUST NOT compromise keying material held by any
>          other authenticator within the system.  In the 
> context of a key
>          hierarchy, this means that the compromise of one node in the
>          key hierarchy must not disclose the information necessary to
>          compromise other branches in the key hierarchy.  
> There are many
>          implications of this requirement; however, two implications
>          deserve highlighting.  First, the scope of the 
> keying material
>          must be defined and understood by all parties that 
> communicate
>          with a party that holds that keying material.  
> Second, a party
>          that holds keying material in a key hierarchy must not share
>          that keying material with parties that are associated with
>          other branches in the key hierarchy.
> 
> If keys are propagagted by context transfer, compromise of 
> one router/AP causes compromise of all.
> 
>             jak
> 
> ----- Original Message -----
> From: "COMBES Jean-Michel RD-MAPS-ISS" 
> <[email-masked]>
> To: "James Kempf" <[email-masked]>; "Tschofenig, Hannes" 
> <[email-masked]>; "DENG, HUI -HCHBJ" 
> <[email-masked]>; "Xiaoming Fu" <[email-masked]>; 
> <[email-masked]>; <[email-masked]>
> Cc: "Xiaoming Fu" <[email-masked]>
> Sent: Wednesday, November 23, 2005 4:04 AM
> Subject: RE: [Mipshop] AW: [Mobopts] Presentation slides for 
> "CXTP using GIST"
> 
> 
> > Hi,
> >
> >> -----Original Message-----
> >> From: [email-masked]
> >> [mailto:[email-masked]] On Behalf Of James Kempf
> >> Sent: Tuesday, November 22, 2005 6:04 PM
> >> To: Tschofenig, Hannes; DENG, HUI -HCHBJ; Xiaoming Fu; 
> >> [email-masked]; [email-masked]
> >> Cc: Xiaoming Fu
> >> Subject: Re: [Mipshop] AW: [Mobopts] Presentation slides for "CXTP 
> >> using GIST"
> >>
> >> IPsec context is pretty much out, unless what is exchanged 
> does not 
> >> involve the shared key. So is any AAA context that 
> involves a shared 
> >> key. Please see 
> >> http://www.ietf.org/internet-drafts/draft-housley-aaa-key-mgmt
> >> -01.txt for a discussion of why propagating shared keys in this 
> >> manner is not secure.
> >
> > BTW, IMHO, there are no clear reasons/arguments, about why 
> propagating 
> > shared keys in this manner is not secure, in this draft ....
> >
> >> The draft talks specifically about
> >> AAA-derived keys, but could as well be applied to IPsec 
> derived keys.
> >>
> >>             jak
> >
> > Cheers.
> >
> > JMC.
> >
> > France Telecom - R&D Division - MAPS/NSS Jean-Michel COMBES, 
> > Internet/Intranet Security
> > E-Mail: [email-masked]
> > Phone: +33 (0)1 45 29 45 94
> > Fax: +33 (0)1 45 29 65 19
> > Mobile: +33 (0)6 07 29 30 16
> >
> >>
> >> ----- Original Message -----
> >> From: "Tschofenig, Hannes" <[email-masked]>
> >> To: "DENG, HUI -HCHBJ" <[email-masked]>; "Xiaoming Fu"
> >> <[email-masked]>; <[email-masked]>; <[email-masked]>
> >> Cc: "Xiaoming Fu" <[email-masked]>
> >> Sent: Monday, November 21, 2005 5:23 AM
> >> Subject: [Mipshop] AW: [Mobopts] Presentation slides for 
> "CXTP using 
> >> GIST"
> >>
> >>
> >> > hi hui
> >> >
> >> > there are two issues to discuss:
> >> >
> >> > a) which security mechanisms you use for protection of 
> the context 
> >> > transfer between the old ar and the new ar.
> >> >
> >> > b) which context you transfer between these devices.
> >> >
> >> > i could not remember xiaoming and john proposing to
> >> transfer ipsec sas as
> >> > part of (b). if you would like to transfer ipsec sas 
> then the past 
> >> > investigations in, for example,
> >> <draft-hk-seamoby-ct-ipsec-00.txt> or
> >> > <draft-gopal-seamoby-ipsecctxt-issues-01.txt> might be
> >> worth taking a
> >> > look.
> >> >
> >> > ciao
> >> > hannes
> >> >
> >> >> -----Ursprüngliche Nachricht-----
> >> >> Von: [email-masked]
> >> >> [mailto:[email-masked]] Im Auftrag von DENG, 
> HUI -HCHBJ
> >> >> Gesendet: Montag, 21. November 2005 14:05
> >> >> An: Xiaoming Fu; [email-masked]; [email-masked]
> >> >> Cc: John Loughney; Xiaoming Fu
> >> >> Betreff: RE: [Mobopts] Presentation slides for "CXTP using GIST"
> >> >>
> >> >> Hi, Xiaoming
> >> >>
> >> >> I am still wondering how could you handle IPsec SA transfer, 
> >> >> expecially initialize vector and anti-replay window.
> >> >>
> >> >> Thanks
> >> >>
> >> >> -Hui
> >> >>
> >> >>
> >> >> -----Original Message-----
> >> >> From: Xiaoming Fu [mailto:[email-masked]]
> >> >> Sent: 2005-11-20 (星期日) 3:10
> >> >> To: [email-masked]; [email-masked]
> >> >> Cc: John Loughney; Xiaoming Fu
> >> >> Subject: [Mobopts] Presentation slides for "CXTP using GIST"
> >> >>
> >> >>
> >> >>
> >> >> Hi all,
> >> >>
> >> >> Due to time limitation, mostly the Q&As in response to some 
> >> >> reviewers'
> >> >> comments were discussed in the MOBOPTS RG meeting. For anyone 
> >> >> interested in this draft, the slides are available in the 
> >> >> following link:
> >> >>
> >> >> http://user.informatik.uni-goettingen.de/~fu/temp/cxtpgist/CXT
> >> > PusingGIST_IETF64.ppt
> >> >>
> >> >> Please drop me/us a message if you think it may be 
> useful, or any
> >> >> (additional) comments/suggestions you might have.
> >> >>
> >> >> Cheers,
> >> >> Xiaoming
> >> >>
> >> >> _______________________________________________
> >> >> Mobopts mailing list
> >> >> [email-masked]
> >> >> https://www1.ietf.org/mailman/listinfo/mobopts
> >> >>
> >> >> +zy'���+jwbƭ!'ڟ&y'~'^ؚݙz-y֧ںh,v!zz+vb隊V+-jGz���޶ʋ^{^ם"'^jǧ
> >> >>
> >> 
> ؟^ze隊V'jhțuץzע*.&^̬颚g^+az~׫!ޞm觵yr*bz{r鮲)b隊Z+jZr+v+{^-^ֆ)^Zuz}+$yh
> >> ޷
> >> >> +y޲'&+r~ڟ'(z0'!(!}y~b
> >> >>
> >> >
> >>
> >>
> >> --------------------------------------------------------------
> >> ------------------
> >>
> >>
> >> > _______________________________________________
> >> > Mipshop mailing list
> >> > [email-masked]
> >> > https://www1.ietf.org/mailman/listinfo/mipshop
> >> >
> >>
> >>
> >>
> >> _______________________________________________
> >> Mipshop mailing list
> >> [email-masked]
> >> https://www1.ietf.org/mailman/listinfo/mipshop
> >>
> > 
> 
> 
> 
_______________________________________________
Mipshop mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mipshop

---

From: "James Kempf" <[email-masked]>
Date: Wed, 23 Nov 2005 08:30:52 -0800

I am not sure I understand the question. If you mean "why would an attacker 
want to compromise a network in this manner", I must confess I am not an 
expert on the criminal mind, so I can't really answer the question. If you 
mean "how would an attacker accomplish such a compromise", it would require 
either that the network operator is negligent, or possibly as an inside job.

            jak

----- Original Message ----- 
From: "COMBES Jean-Michel RD-MAPS-ISS" <[email-masked]>
To: "James Kempf" <[email-masked]>; "Tschofenig, Hannes" 
<[email-masked]>; "DENG, HUI -HCHBJ" <[email-masked]>; 
"Xiaoming Fu" <[email-masked]>; <[email-masked]>; 
<[email-masked]>
Cc: "Xiaoming Fu" <[email-masked]>
Sent: Wednesday, November 23, 2005 8:19 AM
Subject: RE: [Mipshop] AW: [Mobopts] Presentation slides for "CXTP using 
GIST"

---

From: Jari Arkko <[email-masked]>
Date: Thu, 24 Nov 2005 15:02:17 +0200

James Kempf wrote:

> I am not sure I understand the question. If you mean "why would an 
> attacker want to compromise a network in this manner", I must confess 
> I am not an expert on the criminal mind, so I can't really answer the 
> question. If you mean "how would an attacker accomplish such a 
> compromise", it would require either that the network operator is 
> negligent, or possibly as an inside job.

If I may offer an interpretation of the housley criteria,
I believe "compromise of a node" is, for instance, someone
grabbing an access point or a router from a coffee shop
wall. At the time people were just doing central office
products or cellular networks with large cell size with
relatively good physical security the domino effect was
not an issue. It is now, in the world where a lot of the
equipment is out there in the field.

To give you an example of the kind of things that
would be undesirable, lets assume that a context
transfer protocol that allows a router/access node
to request the context from other devices in the
network. Now, a compromise of *one* such device
would allow the attacker to retrieve any or all
contexts from the entire network. This would be
bad.

--Jari

---

From: "Alper Yegin" <[email-masked]>
Date: Thu, 24 Nov 2005 16:13:10 +0200

> contexts from the entire network. This would be

I think this is one way of using CT, and the result is bad, I agree. But
there are many different ways of using CT, each have different security
implications, threat-wise... For example, the above scenario can be
improved by requiring the mobile to be part of the CT (e.g., generating
a token of CT  authorization). That way, the compromised node cannot
assume the authority to pull any state from any other node.

I agree that unless designed with care, a CT-based solution can be
dangerous. But I think we should do more analysis before we declare the
death of CT :-)

Alper

---

From: Xiaoming Fu <[email-masked]>
Date: Thu, 24 Nov 2005 15:26:20 +0100

I would second Alper's analysis. One way of doing such CT authorization 
was discussed in 
http://www.tmg.informatik.uni-goettingen.de/publications/1132/ICON04_IDKE.pdf 

Xiaoming

---

From: Jari Arkko <[email-masked]>
Date: Thu, 24 Nov 2005 18:56:16 +0200

Alper Yegin wrote:

>But I think we should do more analysis before we declare the
>death of CT :-)
>  
>
Sure. I just gave you an example you want to avoid;
did not mean to imply that there was no other possible
design choices. There are.

--Jari

---

From: "James Kempf" <[email-masked]>
Date: Mon, 28 Nov 2005 11:09:13 -0800

One issue that has puzzled me is whether limiting the lifetime of a 
context-transferred key would violate the Housely Criteria? Suppose that the 
PSK transferred from one access router to another was limited to, say, one 
minute lifetime, during which time the mobile node needed to negotiate a new 
key or it would be cut off. If the old router was compromised, this really 
wouldn't give the attacker an advantage beyond the one minute lifetime of 
the key, and the advantage would only extend the advantage the attacker had 
on the old router. If the new router was compromised, then any key 
negotiated by the mobile node would be compromised regardless. In any case, 
the compromise would not propagate any further than the existing router, 
provided the key computation is done in a way such that future keys are 
computed with sufficient entropy to make them independent of past ones.

There is also, of course, the issue of security on the transport between the 
access routers, but even then it seems like the window of vulnerability is 
limited to whatever lifetime is enforced by the new router on the 
transferred key.

In any event, 802.11r doesn't seem to be looking at context transfer at all, 
so key context transfer may be a dead issue as far as relevant standards go.

Anybody have any thoughts on this?

            jak

----- Original Message ----- 
From: "Alper Yegin" <[email-masked]>
To: <[email-masked]>; <[email-masked]>
Sent: Thursday, November 24, 2005 6:13 AM
Subject: RE: [Mipshop] AW: [Mobopts] Presentation slides for "CXTP using 
GIST"

---

From: "Alper Yegin" <[email-masked]>
Date: Mon, 28 Nov 2005 22:41:14 +0200

> context-transferred key would violate the Housely Criteria? 

I agree that precaution would limit the threat stemming from CT. We
already proposed that in pana-mobopts. 

Alper

> Suppose that
> the
> minute lifetime, during which time the mobile node needed to negotiate
a
> new
> the key, and the advantage would only extend the advantage the
attacker
> had
> There is also, of course, the issue of security on the transport
between
> the
> In any event, 802.11r doesn't seem to be looking at context transfer
at
> all,
> so key context transfer may be a dead issue as far as relevant
standards
> go.