Re: [Sip-security] RE: SIP authentication problem when using RES in Digest-AKA

[Greg Rose <[e-mail]>]

Thanks for your questions.

At 05:42 PM 3/18/2002 +0200, Jari Arkko wrote:
>Greg Rose wrote in response to James Undery:
>
>
>>>The RES 'secret' is surely going to be recalculated each time the
>>>session entropy (i.e. nonce) changes. Thus I'd modify step 4 and add
>>>pre7
>>This is definitely not in line with the intent of AKA, or the existing 
>>architecture.
>
>
>What I understood James proposing is that *if* AKA is used for the
>authentication of an INVITE to the home after being used for authenticating
>a REGISTER, then AKA should be re-run.

Yes, in theory that would be fine, but I did not get this from my reading 
of draft-undery. It appears to me that it uses the same A1 that was 
calculated during the processing of the register message, in the subsequent 
step.

>In the above, do you mean the 3GPP architecture in 'the existing 
>architecture'?
> From what I understand the 3GPP architecture only intends to authenticate 
> REGISTERs
>with AKA. Therefore, if draft-niemi allows anything to happen after the
>first authentication, it is beyond the 3GPP architecture.

Yes, true.

>  If plugging a
>security hole requires that we never allow AKA authentication to be reused
>and always need a new full AKA run, I would say that's fine. Greg, does
>preventing reuse of the same RES help to block the security problem?

It helps but it doesn't completely solve the problem. Whatever the process 
by which RES (old *or new*) is used to calculate the authentication values, 
can be used by a man-in-the-middle:
1. Mal gets the SIP message, and blocks its onward delivery.
2. He quickly sets his lab of computers to the task of finding 32-bit RES.
3. Before the reply timer expires, he can create any message he wants, and 
authenticate it using that value of RES, even though it is only used once.

Note that even a 64-bit RES probably defeats this.

Note also that air-interface ciphering also stops it working, if Mal is on 
the air interface... but he might not be.

>Also, I have proposed simply requiring 128 bit RES values to be used,
>that solves the problem but is there any reason why we couldn't require
>it?

I had understood that there were compatibility issues with this, but that 
is a question for operators to answer... I don't know. Anyway, I'd be 
perfectly happy if that was done; all my objections would go away.

Thanks,
Greg.

Greg Rose                                       INTERNET: [e-mail]
Qualcomm Australia          VOICE:  [phone]   FAX: [phone]
Level 3, 230 Victoria Road,                http://people.qualcomm.com/ggr/
Gladesville NSW 2111    232B EC8F 44C6 C853 D68F  E107 E6BF CD2F 1081 A37C


_______________________________________________
Sip-security mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/sip-security