Re: [kitten] I-D Action: draft-ietf-kitten-rfc6112bis-01.txt

[Shawn M Emery <[e-mail]>]

Thanks for your review.  Comments in-line.

On 08/ 2/16 10:25 AM, Greg Hudson wrote:
> On 07/26/2016 03:38 PM,[e-mail]  wrote:
>> 	Filename        : draft-ietf-kitten-rfc6112bis-01.txt
> This revision appears to be editorial, and would be unlikely to affect
> an implementation.  I do not have any substantive protocol concerns, but
> I do have some minor issues with some of the new wording.
>
> In section 7, "To ensure that an attacker cannot create a channel with a
> given name" was changed to "To ensure that an attacker cannot create a
> channel by observing exchanges."  The original wording may have used
> "name" in a non-intuitive way, but I think the new wording is more
> wrong.  The threat is that a MITM attacker might create two channels
> with the same ticket session key (known to the attacker); the new
> wording suggests that the threat comes from a passive attacker.

Yes, the key word "observing" indicates a passive state.  How about?:

To ensure that an attacker cannot create a channel by obtaining key 
exchanges between the client and KDC, it is desirable that neither the 
KDC nor the client unilaterally determine the ticket session key.

> In this text:
>
>      Such authorization data, if included in the anonymous ticket, would
>      disclose the that the client is a member of the group observed.	
>
> After the changes, there is an extra "the" before "that".

Done.

> In this new block of text:
>
>      This protocol provides a binding between the party which
>      generated the session key and the DH exchange used to generate
>      they reply key.  Hypothetically, if the KDC did not use
>      PA-PKINIT-KX, the client and KDC would perfrom a DH key
>      exchange to determine a shared key, and that key would be used
>      as a reply key.  The KDC would then generate a ticket with a
>      session key encrypting the reply with the DH agreement.  A MITM
>      attacker would just decrypt the session key + ticket using the
>      DH key from the attacker and KDC DH exchange, and re-encrypt it
>      using the key from the attacker and client DH exchange, while
>      keeping a copy of the session key and ticket.  By requiring the
>      session key in a way that can be verified by the client, this
>      protocol binds the ticket to the DH exchange and prevents the
>      MITM attack.
>
> "perfrom" should be "perform".  "session key + ticket" should be
> "session key and ticket".

Done.

> It might be clearer to say "attacker-KDC DH
> exchange" than "attacker and KDC DH exchange", and similarly
> "attacker-client DH exchange".

Agreed.

> "By requiring the session key in a way that..." is not grammatical.
>

How about?:

This protocol binds the ticket to the DH exchange and prevents the MITM 
attack by requiring the session key in a way that can be verified by the 
client.

Thanks again for your review.

Shawn.
--