Subject: [Mobopts] Re: Presentation slides for "CXTP using GIST"

From: Xiaoming Fu <[email-masked]>
Date: Thu, 24 Nov 2005 15:26:20 +0100

I would second Alper's analysis. One way of doing such CT authorization 
was discussed in 
http://www.tmg.informatik.uni-goettingen.de/publications/1132/ICON04_IDKE.pdf 

Xiaoming
Alper Yegin wrote:
>  
> 
>>To give you an example of the kind of things that
>>would be undesirable, lets assume that a context
>>transfer protocol that allows a router/access node
>>to request the context from other devices in the
>>network. Now, a compromise of *one* such device
>>would allow the attacker to retrieve any or all
>>contexts from the entire network. This would be
>>bad.
> 
> 
> I think this is one way of using CT, and the result is bad, I agree. But
> there are many different ways of using CT, each have different security
> implications, threat-wise... For example, the above scenario can be
> improved by requiring the mobile to be part of the CT (e.g., generating
> a token of CT  authorization). That way, the compromised node cannot
> assume the authority to pull any state from any other node.
> 
> I agree that unless designed with care, a CT-based solution can be
> dangerous. But I think we should do more analysis before we declare the
> death of CT :-)
> 
> Alper
> 
> 

_______________________________________________
Mobopts mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mobopts

---

From: Jari Arkko <[email-masked]>
Date: Thu, 24 Nov 2005 18:56:16 +0200

Alper Yegin wrote:

>But I think we should do more analysis before we declare the
>death of CT :-)
>  
>
Sure. I just gave you an example you want to avoid;
did not mean to imply that there was no other possible
design choices. There are.

--Jari

---

From: "James Kempf" <[email-masked]>
Date: Mon, 28 Nov 2005 11:09:13 -0800

One issue that has puzzled me is whether limiting the lifetime of a 
context-transferred key would violate the Housely Criteria? Suppose that the 
PSK transferred from one access router to another was limited to, say, one 
minute lifetime, during which time the mobile node needed to negotiate a new 
key or it would be cut off. If the old router was compromised, this really 
wouldn't give the attacker an advantage beyond the one minute lifetime of 
the key, and the advantage would only extend the advantage the attacker had 
on the old router. If the new router was compromised, then any key 
negotiated by the mobile node would be compromised regardless. In any case, 
the compromise would not propagate any further than the existing router, 
provided the key computation is done in a way such that future keys are 
computed with sufficient entropy to make them independent of past ones.

There is also, of course, the issue of security on the transport between the 
access routers, but even then it seems like the window of vulnerability is 
limited to whatever lifetime is enforced by the new router on the 
transferred key.

In any event, 802.11r doesn't seem to be looking at context transfer at all, 
so key context transfer may be a dead issue as far as relevant standards go.

Anybody have any thoughts on this?

            jak

----- Original Message ----- 
From: "Alper Yegin" <[email-masked]>
To: <[email-masked]>; <[email-masked]>
Sent: Thursday, November 24, 2005 6:13 AM
Subject: RE: [Mipshop] AW: [Mobopts] Presentation slides for "CXTP using 
GIST"

> Mipshop mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/mipshop
>