Re: [secdir] Review of draft-ietf-opsec-routing-protocols-crypto-issues-04

[Sam Hartman <[e-mail]>]

    Sandra> Since we are NOT discussing failures in keyed MD5 that would
    Sandra> permit someone who did not know the key to produce a valid
    Sandra> digest, it must be the case that the attacker is someone who
    Sandra> knows the key - in other words a valid participant.

    Sandra> So.  What would a collision attack allow a valid participant
    Sandra> to do that a valid participant could not already do?  We
    Sandra> know for sure that valid participants can transmit "wrong
    Sandra> topology descriptions" without resorting to the trouble of
    Sandra> finding a hash collision between packets.

O!
I finally understand your question.
Intuitively the answer is that the attacker should not be able to do
anything with a collision  that they cannot already do by knowing the
key, so I didn't even consider that you could be asking this question.

Of course, with many intuitive things, when you actually question the
intuition, it's not obvious why it's true.  However I think I've come up
with an argument.

For a collision attack  to be valuable to the person producing the hash,
the hash needs to be consumed at multiple points in time.
The attacker wins by having the hash consumed associated with m1 at one
point and m2 at another point.

For example, consider the attack where I sign m1 and then later claim to
have signed m2.
That attack is interesting because someone remembers the hash or at
least depends on the hash  and then later is asked to consider the
second message with a given hash.

>From this, I think that if the cryptographic hash is only used to verify
a packet transmitted along-side the hash that a collision is not useful.
The attacker could have simply sent another packet with a different
hash.

Here are some cases though  which a protocol might engage in where this
does not fit:

1) Participants use the hash to identify which packets they've seen in
the past

2) Participants use hashes  to see which packets other participants have
already seen

3) Participants use hashes to identify the base of some delta to an
object

So any case where the lifetime of the hash is longer than just the MAC
verification, I think there is at least the potential for a collision to
be valuable.

I believe at least for OSPF, the attacker gains nothing from collision
attacks.  IS-IS may be more complicated because I think there it's the
content that is MACed not the packet.