Re: [Hipsec] Eric Rescorla's Discuss on draft-ietf-hip-native-nat-traversal-28: (with DISCUSS and COMMENT)

Eric Rescorla <ekr@rtfm.com> Thu, 20 February 2020 14:05 UTC

Return-Path: <ekr@rtfm.com>
X-Original-To: hipsec@ietfa.amsl.com
Delivered-To: hipsec@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 04C3012003E for <hipsec@ietfa.amsl.com>; Thu, 20 Feb 2020 06:05:31 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.896
X-Spam-Level:
X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BdG7IINohHbt for <hipsec@ietfa.amsl.com>; Thu, 20 Feb 2020 06:05:28 -0800 (PST)
Received: from mail-lf1-x12a.google.com (mail-lf1-x12a.google.com [IPv6:2a00:1450:4864:20::12a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B9355120830 for <hipsec@ietf.org>; Thu, 20 Feb 2020 06:05:27 -0800 (PST)
Received: by mail-lf1-x12a.google.com with SMTP id l16so3200836lfg.2 for <hipsec@ietf.org>; Thu, 20 Feb 2020 06:05:27 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=xSCvtUpMWz2sMXgCjwIIBR1NfZiX3tuuLGBpzS6lUxU=; b=qZqIpmZDUVs1D2iwnNcbGOweh6XOqEvQmfew5z9n31bakDCSHrgSncyXj1lZv2cx3T H33bOdlnF0Ym2irRFtgvjWetxvvXQrH8MOatvSjYYYiboqUz6dKT87aMzvRXn1xT0SIK +MRd9bUCrgwXPP8app2mExHyowl9P2kBki9LjUl0uJNbjiRBZ7tKIADzM9uBROW1zIvy 44bsomQETi0ANOwU4/NVM8CdHSHw9iGDL09Z3bF+l4E+nNNofWOSKTL9wQPxV/kcaqix R1VySuKk/bmkzUA6LPdm4jh2sRJnKB0e9adGv+3EE1gCg0LM64o1NBStcQ9U4cBv8qFb m/0g==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=xSCvtUpMWz2sMXgCjwIIBR1NfZiX3tuuLGBpzS6lUxU=; b=hVeBIRKpXiY70itf36dDryuinGmbzZqre3uB1naRedDywt8O3l/P7KCS8QmmXZQBT/ s6uFIzNKPkZjarnK14/e0Z8Wb9g85/nDOSoEZZN0SfPCiNIv51UXcUtMxN5l925UOux6 2PqM73lYG51xffny5l/wHrYyawNfr8faAhV5m5G4WfGm6izb4epQ7QZ3Qkuui/omP0UF G7pr7UFPchzHg4fcP0vMdN3j/9OxGFPcHZznxjVamk1qZfDzRPtATCbpQQ2Dym/c2qky tvCPLWRegxpe4p5m8w6njlFVvxGJEDdPjyu7bBy2RfVYaTb4lznW2aODhzfC5UkBfs/O VqUQ==
X-Gm-Message-State: APjAAAWKElkbNn5xRapv0bm+7WfpoOAr2SRv3il51KHbMNiyR8M8bYOY IBc/bOGaIyorWXVlBlrzWkhsThcKzUVJlh4Y/mTToA==
X-Google-Smtp-Source: APXvYqxcmLVJlHuW34Gd0KF98JD4K+5qQA2PZjPe7KAUumfT4bXnuHjYNmX4N34MipzDF9CBumMbMH/UqpBeBwnHrxM=
X-Received: by 2002:a05:6512:1086:: with SMTP id j6mr2769079lfg.14.1582207525960; Thu, 20 Feb 2020 06:05:25 -0800 (PST)
MIME-Version: 1.0
References: <152546246777.11589.13288594519409569524.idtracker@ietfa.amsl.com> <a657ffe0-3574-850e-3b8d-9b21f6f8825b@ericsson.com> <CABcZeBO3gLUZevW0zTN6RHiuYBY+7d-4DefSNBA3FzhXFWfGQw@mail.gmail.com> <47c0cdb7980fa6b9d85d71de926d24ea50a90930.camel@ericsson.com> <CABcZeBOVzKyd1Q6uYi66AFEazhW5OSOwYMBnUqGvjHRk4+0DtA@mail.gmail.com> <20b7460348acc2f3d958ab8ed66a70b49448289a.camel@ericsson.com>
In-Reply-To: <20b7460348acc2f3d958ab8ed66a70b49448289a.camel@ericsson.com>
From: Eric Rescorla <ekr@rtfm.com>
Date: Thu, 20 Feb 2020 06:04:49 -0800
Message-ID: <CABcZeBNVBEATYW6-OKK8C0dJ=NzvhRp2N2xmStgNWqTYqQ7-xQ@mail.gmail.com>
To: Miika Komu <miika.komu@ericsson.com>
Cc: "draft-ietf-hip-native-nat-traversal@ietf.org" <draft-ietf-hip-native-nat-traversal@ietf.org>, "hip-chairs@ietf.org" <hip-chairs@ietf.org>, "iesg@ietf.org" <iesg@ietf.org>, Gonzalo Camarillo <gonzalo.camarillo@ericsson.com>, "hipsec@ietf.org" <hipsec@ietf.org>
Content-Type: multipart/alternative; boundary="0000000000008bd530059f0265f3"
Archived-At: <https://mailarchive.ietf.org/arch/msg/hipsec/qLYyp-eoPvt8M_OiT1C755bdWdY>
Subject: Re: [Hipsec] Eric Rescorla's Discuss on draft-ietf-hip-native-nat-traversal-28: (with DISCUSS and COMMENT)
X-BeenThere: hipsec@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is the official IETF Mailing List for the HIP Working Group." <hipsec.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/hipsec>, <mailto:hipsec-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/hipsec/>
List-Post: <mailto:hipsec@ietf.org>
List-Help: <mailto:hipsec-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hipsec>, <mailto:hipsec-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 20 Feb 2020 14:05:31 -0000

On Wed, Feb 19, 2020 at 10:50 PM Miika Komu <miika.komu@ericsson.com> wrote:

> Hi Eric,
>
> ke, 2020-02-19 kello 13:20 -0800, Eric Rescorla kirjoitti:
> > > > > > S 5.8.
> > > > > >>
> > > > > >>    5.8.  RELAY_HMAC Parameter
> > > > > >>
> > > > > >>       As specified in Legacy ICE-HIP [RFC5770], the
> > > RELAY_HMAC
> > > > > parameter
> > > > > >>       value has the TLV type 65520.  It has the same
> > > semantics
> > > > > as RVS_HMAC
> > > > > >>       [RFC8004].
> > > > > >
> > > > > > What key is used for the HMAC?
> > > > >
> > > > > clarified this as follows:
> > > > >
> > > > > [..] It has the same semantics as RVS_HMAC as specified in
> > > section
> > > > > 4.2.1
> > > > > in [RFC8004].  Similarly as with RVS_HMAC, also RELAY_HMAC is
> > > is
> > > > > keyed
> > > > > with the HIP integrity key (HIP-lg or HIP-gl as specified in
> > > > > section 6.5
> > > > > in [RFC7401]), established during the relay registration
> > > procedure
> > > > > as
> > > > > described in Section 4.1.
> > > >
> > > > This seems like it might have potential for cross-protocol
> > > attacks on
> > > > the key. Why
> > > > is this OK>
> > >
> > > this is standard way of deriving keys in HIP. The keying procedure
> > > is
> > > the same as with specified in RFC8004. If there is some attack
> > > scenario, please describe it in detail?
> > > Or is there some editorial issue here?
> >
> > I'm not sure. When I read this text it appears to say that you should
> > be using the same key for two kinds of messages. Is that correct?
>
> the key is always specific to a Host Association, i.e., unique between
> a Relay Client and a Relay Server. So if there is a Rendezvous server
> (used with RVS_HMAC), this would be a different host and different Host
> Association. If the same host provides both rendezvous and relay
> service, it should be fine to reuse the same key.
>

Why is that OK? Generally we try not to do this. Do you have a proof that
it is not possible to have one message mistaken for another?

-Ekr