Subject: Re: [MMUSIC] RTSP session identifiers

From: Magnus Westerlund <[email-masked]>
Date: Mon, 20 Nov 2006 14:57:37 +0100

Joe Pallas skrev:
> Are the requirements in section 3.3 on session identifiers really 
> justifiable?  This seems to be a case where "hard to guess" is being 
> used as a substitute for real security.
> 
>> 3.3 Session Identifiers
>>
>>    Session identifiers are strings of any arbitrary length. A session
>>    identifier MUST be chosen randomly and MUST be at least eight
>>    characters long to make guessing it more difficult. (See Section 20.)
> 
> I ask because I just encountered a client that decided to reject session 
> identifiers less than 8 characters long.  (Thank heavens it didn't also 
> impose its own test for randomness.)  It certainly isn't the client's 
> place to enforce this requirement, but that's not really my point.
> 
> My point is that randomness is used in communication protocols to reduce 
> the likelihood of accidental collisions, not to provide security.  These 
> requirements are either inappropriate,  or inadequate, as it says in 
> section 20:
> 
>>         Session hijacking: Since there is no or little relation between
>>              a transport layer connection and an RTSP session, it is
>>              possible for a malicious client to issue requests with
>>              random session identifiers which would affect unsuspecting
>>              clients. The server SHOULD use a large, random and non-
>>              sequential session identifier to minimize the possibility
>>              of this kind of attack. For real session security, client
>>              authentication needs to be performed.
> 
> Imposing these requirements on the server's choice of session identifier 
> doesn't actually make the protocol more secure, but it does give a 
> possibly dangerous illusion of such.  I would suggest that the 
> requirements be removed, or softened to SHOULD, accompanied by some text 
> that explains that they don't actually provide any true security.
> 

Hi Joe,

Sorry for the very delayed reply on this topic.

Currently RTSP depends on the session ID to provide protection against a 
particular attack and for a particular usage scenario. It might be true 
that this provides less than necessary security and needs a fix. But 
lets start with the scenario we are talking about when the session ID is 
used.

In cases when the client/user is unauthenticated the session ID is used 
to ensure that not anyone else can simply take over controlling the 
session. In other words it is used as weak proof that the one sending 
the request is still the same one that done the first transaction. Or at 
least one authorized by the original session creator. Even if one needs 
to open a new transport connection to perform the control.

I do know that the session ID is not providing particular strong 
security even when kept secret from eavesdropper by exchanging it within 
TLS. But I get the impression that you say that it is totally rubbish.

If what you write is true that the current mechanism is to weak then we 
should include a real mechanism.

As I see it the requirements for a security solution is the following:

1. Do not require any identifier for the client, i.e. no need for the 
client to authenticate its own identity.

2. Enable to authorize subsequent requests in relation to the first one 
to prove that the controlling entity is still the same.

3. To have the authorization to be used over multiple different 
connections to allow for session control transfer between devices of the 
same user, or to handle multihoming, mobility etc.

4. Allow the authorization to be transferable, between clients to allow 
for shared control in between a pool of trusted users.

5. It would be preferable if this would be secure also when not using 
TLS to confidentiality protect, but it is not at all necessary.

If you have some proposal on how to resolve this then I am interested of it.

Cheers

Magnus Westerlund

IETF Transport Area Director & TSVWG Chair
----------------------------------------------------------------------
Multimedia Technologies, Ericsson Research EAB/TVA/A
----------------------------------------------------------------------
Ericsson AB                | Phone +46 8 4048287
Torshamsgatan 23           | Fax   +46 8 7575550
S-164 80 Stockholm, Sweden | mailto: [email-masked]
----------------------------------------------------------------------

_______________________________________________
mmusic mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mmusic