Re: [Hipsec] Eric Rescorla's Discuss on draft-ietf-hip-native-nat-traversal-28: (with DISCUSS and COMMENT)

Eric Rescorla <ekr@rtfm.com> Thu, 20 February 2020 16:59 UTC

Return-Path: <ekr@rtfm.com>
X-Original-To: hipsec@ietfa.amsl.com
Delivered-To: hipsec@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 11E751209A8 for <hipsec@ietfa.amsl.com>; Thu, 20 Feb 2020 08:59:05 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.896
X-Spam-Level:
X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Q76ltJwzytst for <hipsec@ietfa.amsl.com>; Thu, 20 Feb 2020 08:59:02 -0800 (PST)
Received: from mail-lf1-x12b.google.com (mail-lf1-x12b.google.com [IPv6:2a00:1450:4864:20::12b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A40481209B7 for <hipsec@ietf.org>; Thu, 20 Feb 2020 08:59:01 -0800 (PST)
Received: by mail-lf1-x12b.google.com with SMTP id z5so3640750lfd.12 for <hipsec@ietf.org>; Thu, 20 Feb 2020 08:59:01 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=BHxZIe/eo0XnoFWw1brP+gESKHVIajg9i2AilHtR4+4=; b=kJx7Ude2doDzbvAOdRKCAr6v50yUguiY9RH/SbK/cp/Pc5Y6R9LZsdns6v7Sw+HQXY a1DJxXCaPpK7OiygocA95JiWsALr/Ql5oQtzaYr7/KYPVofA2v7LgabTIG8cIPAQHYEp qt+ngqnnN9GLjV6+KEw3pCarPZ07GqhEbVrlhXvUJpyFF58G7WAwyVKstCYrfLfGXt8D P4TCI8sfN6/jCvukREM+u8Ry4asOwHBDDEP9dntfeD66g2XiZQd6Ctv7HoDAgdnlXEXy 0IIl8yF5FTkZi2vhl8lR3zcdu+L6TiBMT3zT8Xxz51sXAFjKTM0gutN8rq+TKP55UZd+ ImGA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=BHxZIe/eo0XnoFWw1brP+gESKHVIajg9i2AilHtR4+4=; b=nPTa9SvTFZPS+h23roxt+Rac3U70S5AdllV879/+lsyolATngqvp7TGE6Emu7IZ022 O+8P4bZp6qUMWGJMXoPdU2JZidoUd6Fbe4nYQDoA2fAeSetKDWkQRRiXkTTbPfHTkzQy mZduO3dNtrSMLiFzz6/PQd7MBQu93b9wvjNqWeGEsIUwX17sjIxGvbN8Ru36kkwwpe4Y ViAjXN6EdBlxt/rl+jU3vN5PZ2sDlGoF4jtxhNE53MHX67oCKrtRem+ppv0OrpyK/mQ5 1IUQbmAN4e1Fq7IWde10zD3sqk3sLhuaHY0/Kzh1qHpAnCxyXH7WxXGrGmdL2BDSNXFI Zuiw==
X-Gm-Message-State: APjAAAXxysOU5pBCtwjECCFn1wiaDtigRwxNKSbtuS2wD1u1CXM2xrPA aLPONOwDBEwCR+UR8hFdjNV7CdnKoPpuSgQtePTzTw==
X-Google-Smtp-Source: APXvYqw8BFjkEw78g8l3yJAxNRm2k+G077QCo3wdDh4kyKE8Sdzy0xE5QD2h/zOqxRAhzjUoO0l9rBbZbz+n4NR/gHs=
X-Received: by 2002:ac2:5582:: with SMTP id v2mr2817636lfg.109.1582217939774; Thu, 20 Feb 2020 08:58:59 -0800 (PST)
MIME-Version: 1.0
References: <152546246777.11589.13288594519409569524.idtracker@ietfa.amsl.com> <a657ffe0-3574-850e-3b8d-9b21f6f8825b@ericsson.com> <CABcZeBO3gLUZevW0zTN6RHiuYBY+7d-4DefSNBA3FzhXFWfGQw@mail.gmail.com> <47c0cdb7980fa6b9d85d71de926d24ea50a90930.camel@ericsson.com> <CABcZeBOVzKyd1Q6uYi66AFEazhW5OSOwYMBnUqGvjHRk4+0DtA@mail.gmail.com> <20b7460348acc2f3d958ab8ed66a70b49448289a.camel@ericsson.com> <CABcZeBNVBEATYW6-OKK8C0dJ=NzvhRp2N2xmStgNWqTYqQ7-xQ@mail.gmail.com> <82ded3745fe403d24c3866845f5f202f182f9d1e.camel@ericsson.com>
In-Reply-To: <82ded3745fe403d24c3866845f5f202f182f9d1e.camel@ericsson.com>
From: Eric Rescorla <ekr@rtfm.com>
Date: Thu, 20 Feb 2020 08:58:22 -0800
Message-ID: <CABcZeBM2Tm5EuF=htBBD0qyYpKarvvgE_LbTKU8n9oBQVPZdsA@mail.gmail.com>
To: Miika Komu <miika.komu@ericsson.com>
Cc: "draft-ietf-hip-native-nat-traversal@ietf.org" <draft-ietf-hip-native-nat-traversal@ietf.org>, "hip-chairs@ietf.org" <hip-chairs@ietf.org>, "iesg@ietf.org" <iesg@ietf.org>, Gonzalo Camarillo <gonzalo.camarillo@ericsson.com>, "hipsec@ietf.org" <hipsec@ietf.org>
Content-Type: multipart/alternative; boundary="0000000000004203dd059f04d241"
Archived-At: <https://mailarchive.ietf.org/arch/msg/hipsec/E1dEbXmXup8bmDW2Klv4_EWOFkg>
Subject: Re: [Hipsec] Eric Rescorla's Discuss on draft-ietf-hip-native-nat-traversal-28: (with DISCUSS and COMMENT)
X-BeenThere: hipsec@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is the official IETF Mailing List for the HIP Working Group." <hipsec.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/hipsec>, <mailto:hipsec-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/hipsec/>
List-Post: <mailto:hipsec@ietf.org>
List-Help: <mailto:hipsec-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hipsec>, <mailto:hipsec-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 20 Feb 2020 16:59:10 -0000

On Thu, Feb 20, 2020 at 7:38 AM Miika Komu <miika.komu@ericsson.com> wrote:

> Hi Eric,
>
> to, 2020-02-20 kello 06:04 -0800, Eric Rescorla kirjoitti:
> >
> >
> > On Wed, Feb 19, 2020 at 10:50 PM Miika Komu <miika.komu@ericsson.com>
> > wrote:
> > > Hi Eric,
> > >
> > > ke, 2020-02-19 kello 13:20 -0800, Eric Rescorla kirjoitti:
> > > > > > > > S 5.8.
> > > > > > > >>
> > > > > > > >>    5.8.  RELAY_HMAC Parameter
> > > > > > > >>
> > > > > > > >>       As specified in Legacy ICE-HIP [RFC5770], the
> > > > > RELAY_HMAC
> > > > > > > parameter
> > > > > > > >>       value has the TLV type 65520.  It has the same
> > > > > semantics
> > > > > > > as RVS_HMAC
> > > > > > > >>       [RFC8004].
> > > > > > > >
> > > > > > > > What key is used for the HMAC?
> > > > > > >
> > > > > > > clarified this as follows:
> > > > > > >
> > > > > > > [..] It has the same semantics as RVS_HMAC as specified in
> > > > > section
> > > > > > > 4.2.1
> > > > > > > in [RFC8004].  Similarly as with RVS_HMAC, also RELAY_HMAC
> > > is
> > > > > is
> > > > > > > keyed
> > > > > > > with the HIP integrity key (HIP-lg or HIP-gl as specified
> > > in
> > > > > > > section 6.5
> > > > > > > in [RFC7401]), established during the relay registration
> > > > > procedure
> > > > > > > as
> > > > > > > described in Section 4.1.
> > > > > >
> > > > > > This seems like it might have potential for cross-protocol
> > > > > attacks on
> > > > > > the key. Why
> > > > > > is this OK>
> > > > >
> > > > > this is standard way of deriving keys in HIP. The keying
> > > procedure
> > > > > is
> > > > > the same as with specified in RFC8004. If there is some attack
> > > > > scenario, please describe it in detail?
> > > > > Or is there some editorial issue here?
> > > >
> > > > I'm not sure. When I read this text it appears to say that you
> > > should
> > > > be using the same key for two kinds of messages. Is that correct?
> > >
> > > the key is always specific to a Host Association, i.e., unique
> > > between
> > > a Relay Client and a Relay Server. So if there is a Rendezvous
> > > server
> > > (used with RVS_HMAC), this would be a different host and different
> > > Host
> > > Association. If the same host provides both rendezvous and relay
> > > service, it should be fine to reuse the same key.
> >
> > Why is that OK? Generally we try not to do this. Do you have a proof
> > that it is not possible to have one message mistaken for another?
>
> so I assume we are talking about the (artificial) case where a single
> host provides both Relay and Rendezvous service, and is communicating
> with a single registered Client? It's the same control channel, so I
> don't see any need to have different HMAC keys for different messages
> since it's still the same two hosts. Or maybe I misunderstood your
> scenario, so please elaborate?
>

The concern is what's known as a "cross-protocol" attack. Is there any
situation in which there might be ambiguity about two message types that
are protected with the same key?

-Ekr