Re: [IPsec] Call for adoption: The NULL Authentication Method in IKEv2 Protocol

The subject line (and the comment on Bellovin attack) caught my eye. I
don't follow the discussions in this list so I don't know how much the need
and dangers of unauthenticated methods were discussed here. I want to point
out that (and probably many did before me) that un-authentication is a very
tricky option especially in a protocol that was created with mutual
authentication as a core requirement and assumption. I can see potential
benefits and uses but I can also see it abused and misused (the internet
draft doesn't do too good a job warning about it but even if it did, people
will misuse it).

But requirements aside, I cannot vow for the security of IKE's key exchange
in a one-way authentication mode. No one (that I know, definitely not me)
designed this protocol to support one-way authentication. So the question
of whether it is secure in this setting has not been investigated.
Moreover, I see that the draft uses shared-key fields for the anonymous
side of the communication and, I imagine, the other can use signature-based
authentication. What security properties do you get from that mix-and-match
authentication methods?

One likely misuse of this technique is that people will use unauthenticated
(or one-way) IKE and will run some other authentication on top of it (say,
password based or whatever). Well, protocols do not necessarily compose
securely. TLS had many failures like that (BEAST, re-negotiation, triple
handshake, ...) and IPsec saw examples of that in the combinations of
unauthenticated ESP and AH. IKE's cryptographic design has endured the test
of time but these variations (or improvisations) endanger it.

Finally, since Bellovin's attack was mentioned, I want to make sure that no
one is thinking of not using the MAC authentication at the IP packet level,
right?

Hugo

On Mon, Sep 8, 2014 at 10:54 AM, <Paul_Koning@dell.com> wrote:

>
> On Sep 7, 2014, at 2:53 PM, Yaron Sheffer <yaronf.ietf@gmail.com> wrote:
>
> > Dear working group,
> >
> > This is a call for adopting draft-smyslov-ipsecme-ikev2-null-auth as a
> WG document. Please respond to this mail with a Yes or No and a short
> rationale, at latest by Friday Sep. 12.
>
> Maybe.
>
> I understand and support the rationale for this draft.
>
> The Security Considerations seems to be inadequate.  Whenever possible,
> real authentication should be used.  So the Security Considerations should
> explicitly and strongly emphasize that, and recommend that products that
> incorporate Null authentication should strive to avoid its use whenever
> possible, and steer users away from its use when they can.
>
> A related question: does the use of Null authentication open up the
> Bellovin attack?  It seems that it would.  If so, my answer changes to “NO”.
>
>         paul
>
> _______________________________________________
> IPsec mailing list
> IPsec@ietf.org
> https://www.ietf.org/mailman/listinfo/ipsec
>