Re: [Hipsec] CLOSE and identical session keys

[Tobias Heer <[e-mail]>]

Hello Tom (and everyone else involved),

Am 20.10.2010 um 17:16 schrieb Henderson, Thomas R:
>> [...]
>> a) add a recommendation that a host SHOULD to not send the
>> same puzzle to a host twice. A host can use the opaque field
>> in the puzzle to generate unique puzzle parameters (e.g., by
>> using a counter as input for the generation of I and by using
>> the opaque field in the puzzle to remember it).
>> 
>> or
>> 
>> b) add MUST to use different puzzles. This may be a bit more
>> costly because a host could deprive the puzzles that can be
>> indexed with the opaque field with 2^16 I1 packets. In that
>> case the responder would have to increase the R1 generation
>> counter (and would possibly generate new DH keys and
>> signatures for these).
>> 
>> Any opinions?
>> 
> 
> I had some similar thoughts when originally replying (about the possible need to detect replayed CLOSE packets) and of the two choices above, I would probably favor a).
> 

My suggestion for the new passage for RFC5201-bis:

   The puzzle value I and the solution J are inputs for deriving the
   keying material from the Diffie Hellman key exchange (Section 6.5).
   Therefore, a responder SHOULD NOT use the same puzzle I with the same
   DH keys for the same Initiator twice to ensure that the derived
   keying material differs.  Such uniqueness can be achieved, for
   example, by using a counter as input for generating I. This counter
   can be increased for each processed I1 packet.  The state of the
   counter can be transmitted in the Opaque data field in the PUZZLE
   (Section 5.2.4), in an ECHO_REQUEST_SIGNED (Section 5.2.19) or in an
   ECHO_REQUEST_UNSIGNED parameter (Section 5.2.20) without the need to
   establish state.

Any comments / suggestions?

However, with this passage some other text on the puzzle requires minor changes and clarifications as well.

BR,

Tobias




-- 
Dipl.-Inform. Tobias Heer, Ph.D. Student
Chair of Communication and Distributed Systems - comsys
RWTH Aachen University, Germany
tel: [phone]
web: http://ds.cs.rwth-aachen.de/members/heer
blog: http://dtobi.wordpress.com/
card: http://card.ly/dtobi