Subject: [Sipping] 3gpp security proposal

From: Rohan Mahy <[email-masked]>
Date: Mon, 19 Nov 2001 06:45:42 -0800

Hi Everyone,

As I understand it, 3gpp has a requirement for both end-to-end mutual 
entity/user authentication, and also hop-by-hop message integrity, and 
entity authentication.  Furthermore, 3gpp would like to avoid PKI.

It occured to me that setting this up is possible using kerberos using very 
few roundtrips.  The flow is very simple, and is described below.

In parallel, the mobile terminal would send two separate authenticator 
requests to its home KDC.  The first, would be for an "end-to-end" session 
ticket with the S-CSCF, and the second would be for a "hop-by-hop" session 
ticket with the P-CSCF.  The second request would use the PKCROSS option 
for cross-realm authentication with the visited KDC.  (The session key in 
the second ticket can now be used for end-to-end auth.)

Finally, the mobile terminal would use KINK to request an IPsec SA with the 
P-CSCF. (a single roundtrip to the PCSCF).

At this point the mobile terminal could use IPsec to communicate with the 
P-CSCF, and optionally HTTP digest to authenticate end-to-end with the 
S-CSCF.  Clearly we need to do more work on end-to-end auth, but I think 
this is a good starting point for discussion.

Comments welcome.
thanks,
-rohan

_______________________________________________
Sipping mailing list  http://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: "Jari Arkko" <[email-masked]>
Date: Mon, 19 Nov 2001 22:00:40 +0200

Hello Rohan,

> the second ticket can now be used for end-to-end auth.)

You meant the first ticket? By the way, doesn't PK-CROSS require two
roundtrips, since you need to talk first to the home KDC and then to the
visited? I could be mistaken but that's what I seem to read from the draft.
So the e2e ticket needs one, and the h2h needs two. In any case,
I like your approach of running the two requests in parallel!

> P-CSCF. (a single roundtrip to the PCSCF).

So, at this point we have max(1,2)+1+2 = 5 roundtrips to (a) get the tickets,
(b) get the IPsec SA, and (c) do the first SIP message with a HTTP authentication
style 401+resubmit procedure. Well, point c's roundtrips above depends on
how we'd do the end-to-end auth and as you say there are no details yet
so perhaps this could also be done in a more efficient way. I believe the
current assumption in 3g networks is by the way a total of 2 roundtrips,
which assumes HTTP-authentication style procedure, some h2h protection
which doesn't add roundtrips (esp for instance), and the cross-domain
trust to delegate integrity protection and a session key to the P-CSCF.

> this is a good starting point for discussion.

Yes. A few items for discussion:

* End-to-end auth as you indicate above. I personally think that e2e and e2m
  should get more attention in SIP, though most folks seem to ignore it for
  now.

* The amount of needed infrastructure in different approaches (how much
   stuff do you need at the visited networks?). Does the Kerberos approach
   need more servers than the other approach?

* The number of roundtrips ;-)

* Various security implications of trusting visited realms in different
   ways. Is there a difference in the ticket approach for this vs. the
   delegation approach?

* Maybe some Kerberos expert could tell me if the delegation feature
  in Kerberos would be useful in this context for something. While you're
  at it, I read somewhere (draft-aboba-pppext-eapgss-08.txt) that Kerberos
  V is vulnerable to dictionary attacks and the fix would potentially involve
  PKINIT (and therefore public keys). Can anyone confirm this?

Jari

---

From: Rohan Mahy <[email-masked]>
Date: Mon, 19 Nov 2001 12:53:41 -0800

Hi Jari,

Comments inline..

>I like your approach of running the two requests in parallel!

As I understand it, PKCROSS requires the home KDC to contact the visited 
KDC, but this only needs to be done once for the ticket lifetime (days or 
many hours).  so if 50 subscribers from the home network are roaming 
anywhere with a visited carrier, only PKCROSS roundtrip is needed for the 
first, and the rest need none.

>trust to delegate integrity protection and a session key to the P-CSCF.

yes, also note that the KINK roundtrip is just to the P-CSCF, so the 
latency here could be much lower.

>   should get more attention in SIP, though most folks seem to ignore it for

agreed 100%

>    need more servers than the other approach?

I don't think so.  We'd have to ask someone about the state of kerberos 
implementations.

>    ways. Is there a difference in the ticket approach for this vs. the

I think the ticket approach is more flexible, as you can be explicit about 
what gets done with the ticket.  This will require more analysis to see if 
this translates practically in the 3gpp environment.

thanks,
-rohan