Re: [hiprg] clarification of identity privacy properties of HIP base exchange

[Andrei Gurtov <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Henderson, Thomas R wrote:
> There is a paragraph in the HIP experiment report, Section 8:
> http://tools.ietf.org/html/draft-irtf-hip-experiment-10
> for which I am wondering whether it is completely correct.
> 
> 
>    All two-round-trip variations of the Diffie Hellman key exchange
>    using public keys for authentication are vulnerable to identity
>    theft.  The Responder must not generate the shared session key before
>    receiving two messages from the Initiator, to avoid DoS attacks.  If
>    the Responder sends its public key in the first reply message (R1) to
>    the Initiator, the Responder's identity will be revealed to third
>    parties.  The Initiator cannot determine the identity of the
>    Responder until after receiving the last message (R2) of the key
>    exchange.  As a result, an active attacker can find out the public
>    key and identity of the Initiator by pretending to be a trusted
>    correspondent host.  The Initiator's public key is sent encrypted in
>    the third message of the Diffie Hellman key exchange and can be
>    decrypted by an attacker based on the established session key.
> 
> Some questions:
> 1) (fourth sentence) The R1 sends HOST_ID and is signed, so can't the Initiator learn the identity in the first reply message?  Or is this referring to possible R1 replay by an adversary?

- From the content of R1 packet it indeed looks like Initiator can
identify the Responder based on the public key. Replays are a
possibility, but still the attacker wouldn't be able to alter the packet
or misuse the responder's identity, just resend the same packet.

A related question is how R1s can be pre-generated (I think RFC5201
refers to this possibility). R1 includes at least the destination HIT so
how the signature can be constructed in advance? Also the puzzle can
have expiration lifetime.

> 2) (fifth and sixth sentence) In what situations can an active attacker learn the key and identity of the Initiator (if the Initiator chooses to encrypt HOST_ID)?   Opportunistic mode may be one, but are there others?

I guess in any case when the public key of the recipient is not
authenticated (e.g. by DNSSEC) and when the initiator attempts
connecting without taking the ID of Responder from a trusted source.
(e.g. someone storing own public key in DHT under domain name google.com)

Andrei
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk1biYIACgkQP7jp0uceFkTznwCg1dshsXsepBvi3skKwzOfcxm+
Pv4AoL0hb12mgvYcZQ5hu8w6wcYPOfD4
=djBX
-----END PGP SIGNATURE-----