Subject: Re: [Rift] RIFT security review

From: "Scott G. Kelly" <[email-masked]>
Date: Tue, 23 Apr 2019 17:33:27 -0700 (PDT)

Hi Jeffrey,

I haven't yet reviewed the document, but based on your reply, I think that all of my comments are addressed except for one. From Antonio's reply below:

> 
> I was under the impression that nonce is a well-known term in cryptography
> 
> https://en.wikipedia.org/wiki/Cryptographic_nonce
> [https://upload.wikimedia.org/wikipedia/commons/thumb/4/4f/Nonce-cnonce-uml.svg/1200px-Nonce-cnonce-uml.svg.png]<https://en.wikipedia.org/wiki/Cryptographic_nonce>

This is exactly my point: read the definition given for cryptographic nonce: "In cryptography, a nonce is an arbitrary number that can be used just once in a cryptographic communication"

The key here is "just once". Because you expect rollover, and because you allow one side to hold this constant up to 5 minutes (and repeat it in any messages flowing during that interval) the same value can be used more than once. So, it does not meet the commonly understood definition of nonce (and it does not have the security properties commonly expected of a nonce).

--Scott

On Tuesday, April 23, 2019 10:30am, "Jeffrey (Zhaohui) Zhang" <[email-masked]> said:

> Hi Scott,
> 
> Thanks for your security review on RIFT spec. I am copying this to the RIFT
> mailing list.
> 
> Please see Tony's response in the email below and the revisions in
> https://www.ietf.org/id/draft-ietf-rift-rift-05.txt. Could you review again to
> make sure all your comments/concerns have been addressed?
> 
> Thanks!
> Jeffrey
> 
> 
> 
> Juniper Internal
> From: Antoni Przygienda <[email-masked]>
> Sent: Thursday, April 18, 2019 12:34 PM
> To: Jeffrey (Zhaohui) Zhang <[email-masked]>; [email-masked]; Bruno
> Rijsman <[email-masked]>
> Subject: Re: RIFT security review
> 
> My comments on the security review:
> 
> 
> I have reviewed this document as part of the security directorate's ongoing effort
> to review all IETF documents being processed by the IESG.  These comments were
> written primarily for the benefit of the security area directors.  Document
> editors and WG chairs should treat these comments just like any other last call
> comments.
> 
> 
> 
> The summary of the review is ready with issues
> 
> 
> 
> From the abstract, this document outlines a specialized, dynamic routing protocol
> for Clos and fat-tree network topologies.
> 
> 
> 
> (should that read CLOS?)
> 
> Clos was a French mathematician in Bell Labs who invented the stuff so it's really
> "Clos"
> 
> Wikipedia: "Clos networks are named after Bell Labs researcher
> 
> Charles Clos, who proposed the model in 1952 as a way to overcome the
> 
> performance- and cost-related challenges of electromechanical switches then used
> in telephone networks."
> 
>  Following is a brief summary of comments and questions by section.
> 
> 
> 
> 5.4.1 includes this sentence:
> 
> 
> 
>    The most security conscious operators will want to have full control
> 
>    over which port on which router/switch is connected to the respective
> 
>    port on the "other side", which we will call the "port-association
> 
>    model" (PAM) achievable e.g. by pairwise-key PKI.
> 
> 
> 
> What is "pairwise-key PKI"?
> 
> pair-wise set of private/public key, i.e. a designated key pair per port. I'll try
> to word it better
> 
> 
>  Secion 5.4.2 says "Low processing overhead and efficiency messaging are also a
> goal."
> 
> 
> 
> I suggest replacing efficiency with efficient
> 
> ack
> 
>  It also says "Message privacy achieved through full encryption is a non-goal"
> 
> 
> 
> I suggest saying "Message confidentiality is a non-goal" instead.
> 
> ack
> 
>  Section 5.4.3
> 
> "Length of Fingerprint:  8 bits.  Length in 32-bit multiples of the
> 
>       following fingerprint not including lifetime or nonces.  It allows
> 
>       to navigate the structure when an unknown key type is present.  To
> 
>       clarify a common cornercase a fingerprint with length of 0 bits is
> 
>       presenting this field with value of 0."
> 
> 
> 
> Does length 0 mean no fingerprint is present (i.e. fingerprints are not provided)?
> I don't understand that last sentence.
> 
> yes, it does. I try to improve the wording.
> 
>  The definition for "Security Fingerprint" includes this  sentence:
> 
> 
> 
> "If the fingerprint is shorter than the significant bits are left aligned and
> remaining bits are set to 0."
> 
> 
> 
> I don't understand this sentence. I think you mean that      if the fingerprint
> bit length is not an even multiple of 32, then it is left-aligned, and the
> rightmost unused bits are set to 0. But that's just a guess.
> 
> yes, I try to word better.
> 
>  5.4.4
> 
> "Any implementation including RIFT security MUST generate and wrap around local
> nonces properly"
> 
> 
> 
> I see the term "nonce" used elsewhere, but because it can wrap (and therefore
> repeat with regularity),
> I think this is a poor choice for naming this field. It seems to be more of a
> counter.
> I think most security folks would agree that a nonce used for security purposes
> should,
> by definition, repeat only with negligible probability.
> 
> I was under the impression that nonce is a well-known term in cryptography
> 
> https://en.wikipedia.org/wiki/Cryptographic_nonce
> [https://upload.wikimedia.org/wikipedia/commons/thumb/4/4f/Nonce-cnonce-uml.svg/1200px-Nonce-cnonce-uml.svg.png]<https://en.wikipedia.org/wiki/Cryptographic_nonce>
> 
> Cryptographic nonce -
> Wikipedia<https://en.wikipedia.org/wiki/Cryptographic_nonce>
> In cryptography, a nonce is an arbitrary number that can be used just once in a
> cryptographic communication. It is similar in spirit to a nonce word, hence the
> name.It is often a random or pseudo-random number issued in an authentication
> protocol to ensure that old communications cannot be reused in replay attacks.They
> can also be useful as initialization vectors and in cryptographic hash ...
> en.wikipedia.org
> 
> 
> 
>  On a related note, does this really provide anti-replay protection?
> Elsewhere in the document (e.g. section 5.4.4) it says that implementations could
> go up to
> 5 minutes without incrementing nonces. Can they send multiple packets with the
> same
> nonce during this interval? If so, what prevents replay of a captured packet
> within that interval?
> 
> 
> 
> Also, because wrapping (of this 16 bit value) is supported, it's also possible
> that an earlier packet could be replayed (assuming the peer nonce also aligned),
> right? The odds of this seem low, but could the protocol/endpoint states be
> manipulated to improve the odds? Not sure. But if you are assuming this can't
> happen, this security-relevant assumption should be called out.
> 
> 
> 
>   1.  Correct, for efficieny purposes we open up to a 5 min window which we
> consider an acceptable risk per point 2
>   2.  it is the combination of local and remote nonce so it's really a 32 bit
> number. The chance that the combination repeats is obviously very small.
> 
> 
>  5.4.7 says
> 
> 
> 
>    "If an implementation supports disabling the security envelope
> 
>    requirements while sending a security envelope an implementation
> 
>    could shut down the security envelope procedures while maintaining an
> 
>    adjacency and make changes to the algorithms on both sides then re
> 
>    enable the security envelope procedures but that introduces security
> 
>    holes during the disabled period."
> 
> 
> 
> Aside from the fact that this needs word-smithing, should this be called out in
> the security
> considerations section? This eeems to be saying that it's not a good idea to
> temporarily
> maintain adjacency while disabling security, so is this a SHOULD NOT?
> 
> 
> Will improve wording. Yes, it is a SHOULD NOT but sometimes implementations do
> that to not loose adjacency and change keys easily.
> 
> 
>  section 8.4
> 
> flodding -> flooding
> 
> 
> 
> section 8.4 also says
> 
> 
> 
>    It is expected that an
> 
>    implementation detecting too many fake losses or misorderings due to
> 
>    the attack on the number would simply suppress its further processing.
> 
> 
> 
> what are "fake losses"?
> 
> 
> 
> I am not a routing expert, so there may be additional concerns that someone better
> versed in routing would raise.
> Will improve wording. "Fake losses" is a possible attack vector where an attacker
> intercepts packets, modifies the packet number  to simulate a "packet number
> loss/misorder" and forwards the packet on.
> 
> Please fwd' to reviewer if needed & tell me whether you want notification on new
> version ...
> 
> --- tony
> 
> ________________________________
> From: Jeffrey (Zhaohui) Zhang
> Sent: Thursday, April 18, 2019 7:26 AM
> To: Antoni Przygienda
> Subject: RIFT security review
> 
> Hi Tony,
> 
> Please see
> https://datatracker.ietf.org/doc/review-ietf-rift-rift-04-secdir-early-kelly-2019-04-11/.
> 
> Thanks.
> Jeffrey
> 
> Juniper Internal
>

---

From: Antoni Przygienda <[email-masked]>
Date: Wed, 24 Apr 2019 01:32:12 +0000

thanks Scott, I think I added in the document some text saying "that's not _really_ a nonce but close" and that it's really combination of local & remote that is used as salt so it's 32 bits (so replay is staticially only likely for the duration of 5min/2 and only after 1^32/2 sequences have been recorded). If you think the text is not sufficient, we can rename it to "pseudo-nonce" or something like this

I probably misunderstood your comment to an extent ...

I hope that my reasoning as to "performance" in the sense of having a "real" nonce and to cryptographically fingerprint _every_ LIE on evey interface every time and every TIE on transmission/retransmission represening a very high load was clear ...

And even if we insist on "perfect nonces" then we have allow for a "nonce slip" since LIEs may get lost and so on so the protocol must allow +/- 5 nonces local/neighbor anyway to work under lossy links. So there is a a certain replay vector that is unavoidable I think ...

thanks

--- tony

________________________________
From: Scott G. Kelly <[email-masked]>
Sent: Tuesday, April 23, 2019 5:33 PM
To: Jeffrey (Zhaohui) Zhang
Cc: Antoni Przygienda; Bruno Rijsman; [email-masked]
Subject: Re: RIFT security review

Hi Jeffrey,

I haven't yet reviewed the document, but based on your reply, I think that all of my comments are addressed except for one. From Antonio's reply below:

> https://urldefense.proofpoint.com/v2/url?u=https-3A__en.wikipedia.org_wiki_Cryptographic-5Fnonce&d=DwIFaQ&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=maKXfKzgRTpiLitqHnJiww&m=ewT6IR2ygwqlSkxXUvque4qSUqKng8_ycsGJH_mNH6U&s=at8GTl8R0Z06MPVIsuXx0_C74NJeGZ1xePUdjnYACtg&e=
> [https://urldefense.proofpoint.com/v2/url?u=https-3A__upload.wikimedia.org_wikipedia_commons_thumb_4_4f_Nonce-2Dcnonce-2Duml.svg_1200px-2DNonce-2Dcnonce-2Duml.svg.png&d=DwIFaQ&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=maKXfKzgRTpiLitqHnJiww&m=ewT6IR2ygwqlSkxXUvque4qSUqKng8_ycsGJH_mNH6U&s=sxN_f34c3v2_yMpEZgquYcJbHLXu8PmtP6nDuaIkmlc&e=]<https://urldefense.proofpoint.com/v2/url?u=https-3A__en.wikipedia.org_wiki_Cryptographic-5Fnonce&d=DwIFaQ&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=maKXfKzgRTpiLitqHnJiww&m=ewT6IR2ygwqlSkxXUvque4qSUqKng8_ycsGJH_mNH6U&s=at8GTl8R0Z06MPVIsuXx0_C74NJeGZ1xePUdjnYACtg&e=>

--Scott

On Tuesday, April 23, 2019 10:30am, "Jeffrey (Zhaohui) Zhang" <[email-masked]> said:

> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_id_draft-2Dietf-2Drift-2Drift-2D05.txt&d=DwIFaQ&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=maKXfKzgRTpiLitqHnJiww&m=ewT6IR2ygwqlSkxXUvque4qSUqKng8_ycsGJH_mNH6U&s=W2GfTd20tkv2UsNNsAQ5w7JfplP2RJNK1o4Qb-NphAg&e=. Could you review again to
> https://urldefense.proofpoint.com/v2/url?u=https-3A__en.wikipedia.org_wiki_Cryptographic-5Fnonce&d=DwIFaQ&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=maKXfKzgRTpiLitqHnJiww&m=ewT6IR2ygwqlSkxXUvque4qSUqKng8_ycsGJH_mNH6U&s=at8GTl8R0Z06MPVIsuXx0_C74NJeGZ1xePUdjnYACtg&e=
> [https://urldefense.proofpoint.com/v2/url?u=https-3A__upload.wikimedia.org_wikipedia_commons_thumb_4_4f_Nonce-2Dcnonce-2Duml.svg_1200px-2DNonce-2Dcnonce-2Duml.svg.png&d=DwIFaQ&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=maKXfKzgRTpiLitqHnJiww&m=ewT6IR2ygwqlSkxXUvque4qSUqKng8_ycsGJH_mNH6U&s=sxN_f34c3v2_yMpEZgquYcJbHLXu8PmtP6nDuaIkmlc&e=]<https://urldefense.proofpoint.com/v2/url?u=https-3A__en.wikipedia.org_wiki_Cryptographic-5Fnonce&d=DwIFaQ&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=maKXfKzgRTpiLitqHnJiww&m=ewT6IR2ygwqlSkxXUvque4qSUqKng8_ycsGJH_mNH6U&s=at8GTl8R0Z06MPVIsuXx0_C74NJeGZ1xePUdjnYACtg&e=>
>
> Cryptographic nonce -
> Wikipedia<https://urldefense.proofpoint.com/v2/url?u=https-3A__en.wikipedia.org_wiki_Cryptographic-5Fnonce&d=DwIFaQ&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=maKXfKzgRTpiLitqHnJiww&m=ewT6IR2ygwqlSkxXUvque4qSUqKng8_ycsGJH_mNH6U&s=at8GTl8R0Z06MPVIsuXx0_C74NJeGZ1xePUdjnYACtg&e=>
> https://urldefense.proofpoint.com/v2/url?u=https-3A__datatracker.ietf.org_doc_review-2Dietf-2Drift-2Drift-2D04-2Dsecdir-2Dearly-2Dkelly-2D2019-2D04-2D11_&d=DwIFaQ&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=maKXfKzgRTpiLitqHnJiww&m=ewT6IR2ygwqlSkxXUvque4qSUqKng8_ycsGJH_mNH6U&s=ph0HbUWIyvt-sCe809MFpw7LlO3iXVYLDPyoZ6Uze10&e=.
>
> Thanks.
> Jeffrey
>
> Juniper Internal
>