Re: [Cfrg] [T2TRG] Wi-Fi Alliance Device Provisioning Protocol (DPP) - Draft Released for Public Review and Comments

[Dan Harkins <[e-mail]>]

On 8/31/16 5:14 PM, Andy Lutomirski wrote:
>
> On Aug 31, 2016 4:55 PM, "Paul Lambert" <[e-mail] 
> <mailto:[e-mail]>> wrote:
> >
> >
> > I¹ve made a short summary of the PKEX protocol below. Comments and
> > corrections would be appreciated.
> >
> > Assuming my summary is correct ...
> >
> > If a third party Carol with P_c knows the MAC address and public key of
> > Alice (MAC_a and P_a) a MiTM attack is possible.
> >
> > 1) Alice and Bob share a one-time passphrase to bootstrap 
> connectivity and
> > learn each others associated public keys.
> > 2) Alice
> >    - calculates Pwe_ab = huntandpeck(passphrase_ab)   # passphrase 
> between
> > Alice and Bob
> >    - calculates Q_a = H( MAC_a ) * Pwe_a
> >    - sends Commit with nonce_a and C_a = P_a + Q_a
> > 3) Carol intercepts Alice¹s Commit and having met Alice, know¹s P_a and
> > MAC_a
> >    - calculates  Q_a = (C_a - P_a)
> >    - creates spoofed commit as
> >       C¹_a = P_c + Q_a
> >    - send spoofed commit with nonce_c and C¹_a
> > 4) Carol continues PKEX exchange with Bob using MAC_a
> > 5) At end Bob thinks P_c belongs to MAC_a
> >
>
> Nifty!  IMO that's a rather serious problem -- no brute forcing is needed.
>
> I can improve my quadratic attack, too.  Suppose Carol can convince 
> Alice to run the protocol twice with different passwords pw1 and pw2.  
> (The two runs don't even need to be with the same peer.)  Carol learns 
> Q1_a - Q2_a.  With high probability, Carol can now jointly bruteforce 
> pw1 and pw2 without needing to know P_a.  Now Carol can calculate P_a.
>
> Of course, having done so, Carol can now run your attack to MITM any 
> further exchanges involving Alice.
>
> So I guess that passive observation of two protocol runs almost 
> completely breaks PKEX.
>

   What you both seem to have noticed is what is already mentioned in 
the DPP spec
that you both have quite obviously read. Namely,

   "This bootstrapping technique [PKEX] should never be run multiple 
times with
the  same code. Using this bootstrapping technique more than once with a 
different
code but the same bootstrapping key can enable a dictionary attack."

   There are usage constraints. Go beyond them and your assumptions are not
valid anymore. This is true for all of the boostrapping techniques used in
DPP. The NAN-based method assumes the peers are in close proximity and 
that no
adversaries are. A bold assumption-- when there are no adversaries, the 
exchange
is secure! All security is lost if that's not true-- i.e. it "completely 
breaks".
Yet some people still want to use it because they seem comfortable with 
those
usage constraints.

   These bootstrapping techniques are trying to establish "trust" out of 
whole
cloth, or damn near whole cloth. The usage constraints are being mentioned
honestly so people know how to use them and what they're getting when 
they do.
If you think the usage constraints make a particular bootstrapping 
technique be
effectively worthless that is useful information I guess but that 
doesn't mean
it's completely broken.

   Dan.