Re: [martini] #56: GRUU mechanism security review

["martini issue tracker" <[e-mail]>]

#56: GRUU mechanism security review
-----------------------------+----------------------------------------------
 Reporter:  rbarnes@…        |        Owner:  adam@…          
     Type:  defect           |       Status:  reopened        
 Priority:  major            |    Milestone:  milestone1      
Component:  gin              |      Version:  1.0             
 Severity:  In WG Last Call  |   Resolution:                  
 Keywords:                   |  
-----------------------------+----------------------------------------------

Old description:

> Just took a look at the GIN GRUU construction.  It looks correct to
> me, and the split between required and optional seems sensible.  My
> summary of the algorithm is below, in case it's helpful.
>
> The security requirements 2 and 3 in 7.1.2.1 seem poorly specified (1,
> 4, and 5 seem obvious enough).  W.r.t. 2: It seems like the risk here
> is that a PBX might be able to make GRUUs that route to another PBX,
> which is the opposite of what this says.  W.r.t. 3: The current
> algorithm doesn't protect against this; it would need something
> related to time.
>

> ===== KEYS =====
>
> Key     Type         Known to
> SK_SSP  HMAC key     SSP
> pk_SSP  Private key  SSP
> Pk_SSP  Public key   SSP, PBX
> SK_PBX  HMAC key     PBX
>
> ===== GENERATION =====
>
> SSP (general):
>    cookie = [ random; identifies PBX; fixed-length ]
>
> SSP (optional):
>    I = [ identifier for PBX ]
>    J = HMAC(SK_SSP, I) // Prevents spoofing cookies if I is known but
> not SK_SSP
>    cookie = I || J
>
> SSP -> PBX:
>    cookie
>
> PBX:
>    D = [ per-temp-GRUU random ]
>    M = cookie || D
>    E = RSA_Encrypt(Pk_SSP, M)
>    PA = HMAC(SK_PBX, E)
>
> PBX -> UA:
>    temp-gruu = [ E, PA ]
>

> ===== VALIDATION =====
>
> UA' -> SSP:
>    temp-gruu = [ E, PA ]
>
> SSP (general):
>    M' = RSA_Decrypt(pk_SSP, E)
>    cookie' = [ truncated M' ]
>    cookie-valid = [ proprietary ]
>
> SSP(optional)
>    M' = RSA_Decrypt(pk_SSP, E)
>    cookie' = [ truncated M' ]
>    I', J' = [ split cookie' ]
>    cookie-valid = (J' == HMAC(SK_SSP, I'));
>
> SSP (general):
>    if (cookie-valid)
>      generated by SSP for PBX identified by I'
>
> SSP -> PBX:
>    temp-gruu' = [ E, PA ]
>
> PBX:
>    if (PA == HMAC(SK_PBX, E))
>      generated by PBX for UA identified by 'gr'

New description:

 Just took a look at the GIN GRUU construction.  It looks correct to
 me, and the split between required and optional seems sensible.  My
 summary of the algorithm is below, in case it's helpful.

 The security requirements 2 and 3 in 7.1.2.1 seem poorly specified (1,
 4, and 5 seem obvious enough).  W.r.t. 2: It seems like the risk here
 is that a PBX might be able to make GRUUs that route to another PBX,
 which is the opposite of what this says.  W.r.t. 3: The current
 algorithm doesn't protect against this; it would need something
 related to time.

 {{{
 ===== KEYS =====

 Key     Type         Known to
 SK_SSP  HMAC key     SSP
 pk_SSP  Private key  SSP
 Pk_SSP  Public key   SSP, PBX
 SK_PBX  HMAC key     PBX

 ===== GENERATION =====

 SSP (general):
    cookie = [ random; identifies PBX; fixed-length ]

 SSP (optional):
    I = [ identifier for PBX ]
    J = HMAC(SK_SSP, I) // Prevents spoofing cookies if I is known but
 not SK_SSP
    cookie = I || J

 SSP -> PBX:
    cookie

 PBX:
    D = [ per-temp-GRUU random ]
    M = cookie || D
    E = RSA_Encrypt(Pk_SSP, M)
    PA = HMAC(SK_PBX, E)

 PBX -> UA:
    temp-gruu = [ E, PA ]


 ===== VALIDATION =====

 UA' -> SSP:
    temp-gruu = [ E, PA ]

 SSP (general):
    M' = RSA_Decrypt(pk_SSP, E)
    cookie' = [ truncated M' ]
    cookie-valid = [ proprietary ]

 SSP(optional)
    M' = RSA_Decrypt(pk_SSP, E)
    cookie' = [ truncated M' ]
    I', J' = [ split cookie' ]
    cookie-valid = (J' == HMAC(SK_SSP, I'));

 SSP (general):
    if (cookie-valid)
      generated by SSP for PBX identified by I'

 SSP -> PBX:
    temp-gruu' = [ E, PA ]

 PBX:
    if (PA == HMAC(SK_PBX, E))
      generated by PBX for UA identified by 'gr'

 }}}

--

Comment(by henrik@…):

 ( Made the wiki markup engine treat part of the description as literal
 text, to avoid the weird formatting we got when it tried to apply
 markup rules ... )

-- 
Ticket URL: <http://trac.tools.ietf.org/wg/martini/trac/ticket/56#comment:5>
martini <http://tools.ietf.org/martini/>