[Sip-security] Re: SIP authentication problem when using RES in Digest-AKA

Greg Rose wrote:

> >draft-undery-sip-auth-00.txt doesn't make any recommendation as to how the
> >password should be computed. However, I remember that when we took the
> >proposal of using Digest for the first time to 3GPP, we had recommended
> >using IK as the password.
> 
> That's right. draft-undery-sip-auth-00.txt assumes that the password is
> strong, and by itself has no problems. draft-niemi-sipping-digest-aka-00
> assumes that RES is used as the password only once for the authentication,
> and by itself has no problems. Put the two together, and there's a problem...

We are in agreement that IK should be used as the password
for draft-undery. However, I feel that in this discussion we
have been mixing draft-undery and draft-niemi in a manner
that it doesn't clearly show that this is still being
done. Let me try to clarify this situation in light
of the 3GPP architecture:

1. Draft-undery is being used for UE - P-CSCF int. protection.
   Algorithm = MD5, password = IK (communicated to the P-CSCF
   using method X from the S-CSCF).

2. Draft-niemi is being used for UE - S-CSCF authentication.
   Algorithm = AKA and no traditional password, just the
   shared long term secret. The authentication is based on
   RES. As a side effect an IK is produced (and communicated
   to the P-CSCF using means beyond draft-niemi).

So, in this particular case Draft-Undery *does* use the
IK as the password. The only remaining issue is how
Draft-Niemi calculates Digest results, and whether
that reveals anything interesting to attackers. 

Draft-niemi is an application of Digest and as such has some
integrity protection features, and particular way to
calculate Response. This particular way is essentially
MD5(... RES ...). So at this point we are not using IK
twice anywhere. But perhaps there's an attack that would
reveal RES, if it was too short. (I personally think we
should simply require it to be long, but I'll ignore that
for the moment.)

Let's study this by considering two cases:

(a) AKA is run at the beginning and if any further
    communications with the home network take place,
    the RES is cached and used as a password. This
    allows the attack described by Greg. But as
    Aki explained, it seems that we have forbidden
    this in Draft-niemi.

(b) AKA has to be run every time, and a RES can't be
    reused. Is there a problem left then?

Jari

_______________________________________________
Sip-security mailing list
Sip-security@ietf.org
https://www1.ietf.org/mailman/listinfo/sip-security