[rtcweb] DTLS-SRTP with end-to-end security: Short Authentication String

["Fabio Pietrosanti (naif)" <[e-mail]>]

Hi,

i've been reviewing the WebRTC security architecture and it seems to me
that the authors did not considered the value of end-to-end security.

DTLS-SRTP does not provide end-to-end security because it rely on third
party of key authentication.

In the RTCWeb security there is a proposed solution, to use SAS:
http://tools.ietf.org/html/draft-ietf-rtcweb-security-02#section-4.3.2.2

SAS, Short authentication string, allow to achieve end-to-end security
within the DTLS-SRTP end-to-end encryption protocol.

Unfortunately the author of rtcweb-security described the SAS as a bad
way to verify fingerprints.

I would like to argue that SAS are instead a valuable, secure mechanism
to provide end-to-end authentication to an end-to-end encryption system,
thus realizing end-to-end security.

I would like to bring the attention of the WG to provide a MANDATORY
requirement to enable SAS verification.

RFC 6189 (ZRTP) explain the reason why SAS are secure enough and the
comments on the rtcweb-security draft should be reconsidered:
		
		http://tools.ietf.org/html/rfc6189#section-15

  "Some questions have been raised about voice spoofing during the short
   authentication string (SAS) comparison.  But it is a mistake to think
   this is simply an exercise in voice impersonation (perhaps this could
   be called the "Rich Little" attack).  Although there are digital
   signal processing techniques for changing a person's voice, that does
   not mean a MiTM attacker can safely break into a phone conversation
   and inject his own SAS at just the right moment.  He doesn't know
   exactly when or in what manner the users will choose to read aloud
   the SAS, or in what context they will bring it up or say it, or even
   which of the two speakers will say it, or if indeed they both will
   say it.  In addition, some methods of rendering the SAS involve using
   a list of words such as the PGP word list[Juola2], in a manner
   analogous to how pilots use the NATO phonetic alphabet to convey
   information.  This can make it even more complicated for the
   attacker, because these words can be worked into the conversation in
   unpredictable ways.  If the session also includes video (an
   increasingly common usage scenario), the MiTM may be further deterred
   by the difficulty of making the lips sync with the voice-spoofed SAS.
   The PGP word list is designed to make each word phonetically
   distinct, which also tends to create distinctive lip movements.
   Remember that the attacker places a very high value on not being
   detected, and if he makes a mistake, he doesn't get to do it over.

   A question has been raised regarding the safety of the SAS procedure
   for people who don't know each other's voices, because it may allow
   an attack from a MiTM even if he lacks voice impersonation
   capabilities.  This is not as much of a problem as it seems, because
   it isn't necessary that users recognize each other by their voice.
   It is only necessary that they detect that the voice used for the SAS
   procedure doesn't match the voice in the rest of the phone
   conversation."

In any crypto-system if the user is not able to INDEPENDENTLY verify the
integrity of the key exchange we refer it to END-TO-SITE SECURITY.

In any crypto-system if the user is able to INDEPENDENTLY verify the
integrity of the key exchange, we refer it to END-TO-END SECURITY.

So basically WebRTC currently does NOT guarantee end-to-end security.
But making SAS mandatory will allow independent way to verify the keys.

Fabio