Re: [babel] HMAC and DTLS cryptographic state can be maintained indefinitely

I agree with the attack and the solution. Can we also add your analysis to
the Security Considerations section of both drafts? That way someone
reading the text about when to discard this state has a pointer to what
would happen if they don't - my thinking is that the consequences here are
very minor so I wouldn't want a reader to start worrying about a much
worse attack that they're not seeing.

David

On Sat, Dec 22, 2018 at 7:55 AM Toke Høiland-Jørgensen <toke@toke.dk> wrote:

> Juliusz Chroboczek <jch@irif.fr> writes:
>
> > In HMAC, Hellos are authentified, so it is an easy matter to simply
> > discard the cryptographic state (but not the neighbour entry) whenever
> the
> > Hello history becomes empty.  I am planning to add wording to that effect
> > to Section 4.1 of the draft:
> >
> >   The receiver MUST ensure that the cryptographic state (index and seqno)
> >   is discarded after no packet has been accepted for the sender for
> >   a bounded time.  A simple solution is to discard the index and seqno
> >   whenever the both hello histories in the neighbour entry becomes empty
> >   (see Appendix A of RFC6126bis); another solution is to discard the
> index
> >   and seqno after a fixed time interval (e.g. 5 minutes) has elapsed
> since
> >   the last accepted packet.
>
> I have no objections to this :)
>
> -Toke
>
> _______________________________________________
> babel mailing list
> babel@ietf.org
> https://www.ietf.org/mailman/listinfo/babel
>