[Hipsec] RFC5201 Ticket #32:

[Tobias Heer <[e-mail]>]

Hello,

I did a literature search and the only problem I found was the "small subroup"
attack.

The attack is described in RFC2785 (http://tools.ietf.org/html/rfc2785) and was
recently brought up again in [1].

The issue is that an attacker (Initiator) can use a DH key with a smaller
subgroup. This makes finding the private key easier if this process can be
repeated (the Initiator repeats this procedure with different keys for the same
Responder key). Therefore, using a static Responder key can create
vulnerabilities against this attack.

As described in RFC2785 and [1], validating the Initiator key according to
RFC2631 (http://tools.ietf.org/html/rfc2631#section-2.1.5) avoids this issue.
The validation process is simple: "

1. Verify that y lies within the interval [2,p-1]. If it does not,
	the key is invalid.
2. Compute y^q mod p. If the result == 1, the key is valid.
	Otherwise the key is invalid.

"[RFC2785]


TLS (RFC5246) addresses the very same issue by stating:
   "If the same DH keypair is to be used for multiple handshakes, either because
   the client or server has a certificate containing a fixed DH keypair or
   because the server is reusing DH keys, care must be taken to prevent small
   subgroup attacks. Implementations SHOULD follow the guidelines found in
   [SUBGROUP]." [SUBGROUP] = [RFC2785].

I propose to add a similar wording to the text passage in RFC5201-bis that
discusses repeated use of the Responder's DH key.

############### Text for RFC5201-bis ###############
"If the Responder uses the same DH keypair for multiple handshakes. It must
take care to avoid small subgroup attacks [RFC2785]. To avoid these attacks,
when receiving the I2 message, the Responder SHOULD validate the Initiators DH
public key as described in [RFC2785] Section 3.1. In case the validation fails,
the Responder MUST NOT generate a DH shared key and MUST silently abort the HIP
BEX."
############### /Text for RFC5201-bis ###############

Do you have comments or suggestions?

Cheers!

Tobias

References: [1] Alfred Menezes and Berkant Ustaoglu. "On reusing ephemeral keys
in Diffie-Hellman key agreement protocols". International Journal of Applied
Cryptography (January 2010), pp. 154-158.



-- 
Dipl.-Inform. Tobias Heer, Ph.D. Student
Chair of Communication and Distributed Systems - comsys
RWTH Aachen University, Germany
tel: [phone]
web: http://www.comsys.rwth-aachen.de/team/tobias-heer/
blog: http://dtobi.wordpress.com/
card: http://card.ly/dtobi
pgp id: AEECA5BF