Re: [Cfrg] question about DH identity theft vulnerabilities

[Paul Hoffman <[e-mail]>]

I agree with Adam's interpretation of what the draft is trying to say. 
However, I think the draft calling it "identity theft" is a gross 
overstatement. In the common usage, "identity theft" means an attacker 
getting personally identifiable information that can be used to 
impersonate the attacked party.

That is absolutely not what is happening in HIP. An attacker can find 
out the public key being used by the attacked party, and if that key 
comes with a string for matching (such as a domain name or IP address), 
the attacker gets that as well.

Without the private key, the attacker has no way to use the identity 
information to impersonate the attacked party, period.

If there is a concern that the identifying string somehow reveals 
information that can identify the party, then use strings that don't 
reveal such information. Either the relying party needs some good 
identifier for the protocol, or they don't.

--Paul Hoffman