Subject: [MMUSIC] UKS and the difference between the attacks

From: "Martin Thomson" <[email-masked]>
Date: Tue, 05 Mar 2019 22:26:19 -0500

In responding to Flemming's review, I realized that the text about the relationship between the identity-based attack and the purely fingerprint-based attack was not  great.  The key insight was hidden, namely the consequences of different attacker capabilities.

So I've tweaked the text and it now says two things I think clarify things a bit.

In the section on the identity attack:

"This form of unknown key-share attack is possible without compromising signaling
integrity, unless the defenses described in {{fp}} are used.  Endpoints MUST use
the `external_session_id` extension (see {{external_session_id}}) in addition to
the `external_id_hash` ({{external_id_hash}}) so that two calls between the same
parties can't be altered by an attacker."

(That last bit is only really changed to include a "MUST"  rather than a "can".)

In the section on the fingerprint attack defenses:

"This defense is not effective if an attacker can rewrite `tls-id` values in
signaling.  Only the mechanism in `external_id_hash` is able to defend against
an attacker that can compromise session integrity."

I thought that this was important enough to highlight in a separate mail.

For reference, the old text was:

"In order for this attack to work without compromising signaling integrity, it is
likely that the attacker also needs to subvert the session as described in
{{fp}}.  Endpoints can use the `external_session_id` extension (see
{{external_session_id}}) in addition to the `external_id_hash`
({{external_id_hash}}) so that two calls between the same parties can't be
altered by an attacker."