Re: [secdir] secdir review of draft-ietf-6tisch-architecture-21

[Tero Kivinen <[e-mail]>]

David Mandelberg writes:
> > During the authentication the JRC needs to provide the keying material
> > to the joining node, but that does NOT provide protection against
> > spoofed ASN. After the node has actual keys used in the network it
> > still needs to verify the ASN by sending some message to JRC using
> > authentication and verify that JRC replies to that.
> > 
> > If this 2nd step is omitted attacker do following attack:
> > 
> > Joining node (JN)   attacker	     		  JRC
> > 		    <- beacon for ASN=23	  <- beacon for ASN=44
> > See beacon
> > from attacker,
> > assume ASN=23.
> > 
> > Auth->JRC
> > (no security)					  Check authentication
> > 						  Return keys
> > 						  keys->JN
> > 
> > Receive keys
> > send first
> > frame using
> > keys using ASN=23->
> > 
> > 
> > Now, if JN is using extended address to generate nonce, the nonce will
> > be different for all other nonces ever used, even the ASN is faked,
> > and has been used before. On the other hand if JN also receives short
> > address assignment from the JRC, JRC needs to make sure that short
> > address has not been assigned to anybody else before, as if it was
> > used by someone else, and frame sent by JN is encrypted, then attacker
> > will now have two packets with same ASN, and short address, meaning
> > same nonce, and it can now decrypt packets.
> 
> Is this discussion of nonce reuse in any relevant documents already, or 
> is it something that should be added somewhere?

All 802.15.4 documents assume that ASN is already distributed securely
to the nodes having keys. I.e., this attack is not considered by those
documents, as it is outside the scope of them...
-- 
[e-mail]