Re: [secdir] secdir review of draft-ietf-simple-msrp-sessmatch

"Richard L. Barnes" <> Tue, 29 June 2010 16:42 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id F0BE03A6860; Tue, 29 Jun 2010 09:42:40 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.676
X-Spam-Status: No, score=-1.676 tagged_above=-999 required=5 tests=[AWL=0.923, BAYES_00=-2.599]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id MchnrXpTIPXL; Tue, 29 Jun 2010 09:42:40 -0700 (PDT)
Received: from ( []) by (Postfix) with ESMTP id 2EC9F3A6868; Tue, 29 Jun 2010 09:42:40 -0700 (PDT)
Received: from ([]:54895) by with esmtp (Exim 4.71 (FreeBSD)) (envelope-from <>) id 1OTdta-000Jwk-FR; Tue, 29 Jun 2010 12:42:50 -0400
Message-Id: <>
From: "Richard L. Barnes" <>
To: Christer Holmberg <>
In-Reply-To: <>
Content-Type: text/plain; charset="US-ASCII"; format="flowed"; delsp="yes"
Content-Transfer-Encoding: 7bit
Mime-Version: 1.0 (Apple Message framework v936)
Date: Tue, 29 Jun 2010 12:42:48 -0400
References: <> <> <>
X-Mailer: Apple Mail (2.936)
Cc: "" <>, Ted Hardie <>, The IETF <>, "" <>, "" <>
Subject: Re: [secdir] secdir review of draft-ietf-simple-msrp-sessmatch
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Security Area Directorate <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 29 Jun 2010 16:42:41 -0000

>> I also note that the security considerations, in addition to
>> having some fairly disingenuous language about the impact of
>> this change, seems to fail to mention MSRPS URIs and what, if
>> any, impact this would have on them.
> There are no impacts to MSRPS URIs. I assumed it would be implicitly  
> understood since MSRPS URIs are not mentioned in the draft.
> However, we could explicitly make it clear by modifying the first  
> sentences of section 5:
>      "The change of session matching procedure does not impact the  
> format of MSRP URIs,
> 	disregarding if the "msrp" scheme or the "msrps" scheme is used.
> 	However, MSRP endpoints can only check that the session-id part of  
> the MSRP URI..."

The conflict here is that with MRSPS authentication, the name in the  
certificate is checked against the domain name in the URI, which was  
OK when the URI in the message was required to be the same.  By  
allowing the domain name in the message to change, this draft removes  
man-in-the-middle protection from MSRPS.

The document notes that a SIP MitM can already direct the user to  
another destination.  However, if the peers use MSRPS with the current  
authentication scheme, the MitM will not be able to be a part of the  
resulting MSRPS session, since he can't authenticate as one of the  
endpoints.  If only the session ID is used in comparisons, the MitM  
can patch himself in by changing the domain in the MSRPS URI.  (Which  
actually seems to be the intended use case for this draft.)

So the current document does introduce a new MitM vulnerability to