Re: [Cfrg] tcp-md5 "strength"

["David McGrew (mcgrew)" <[e-mail]>]

Hi Stephen,




On 9/29/16, 8:14 AM, "Cfrg on behalf of Stephen Farrell" <[e-mail] on behalf of [e-mail]> wrote:

>
>Hiya,
>
>I was just asked for an estimate for how much effort
>it might be to break tcp-md5 [1] and whether (and for
>whom:-) that might be practical, for any interesting
>kind of break.
>
>If anyone has answers or estimates handy, that'd be
>appreciated.

There are several different types of attacks that are possible on TCP-MD5:

1) attacks on the "secret-suffix MAC” used in that construction: (see Preneel and Van Oorschot, "MD-x MAC and building fast MACs from hash functions", Advances in Cryptology Crypto '95 Proceedings).  The attacker needs to find two messages M, M’ that hash to the same value, then they can substitute one message for the other, when it appears on the wire.  Applying this attack to TCP-MD5 is not exactly straightforward, because the attacker doesn’t have a chosen-message oracle, but it probably feasible with O(2^64) operations.   A good variant would be for the attacker to create a large set of (message, hash) pairs, then observe the victim traffic until a collision occurs between that set and the hash of the messages on the wire.

2) replay attacks, or session-splicing attacks.   These are especially successful if the attacker goes active and forces a reset of the TCP session, in which case about 256 resets are typically needed to create the window overlap needed to make an attack possible.

3) offline dictionary attacks, which will work whenever the key is predictable.

#1 would be the most interesting to study, #2 is probably the easiest to pull off, and #3 is the stealthiest.  

Don’t use TCP-MD5!

best

David


>
>Cheers,
>S.
>
>PS: Yes, I know tcp-md5 is pretty to very crappy,
>sadly, it's still used and hard to displace :-(
>
>[1] https://tools.ietf.org/html/rfc2385
>