Re: SNMPv2 security

[Julie Tarr <[e-mail]>]

Kastenholz says:

> Look, either Kold is compromised or it isn't. If it is compromised,
> it does not matter whether you send Knew encrypted with DES/Kold, or
> XORing Knew and Kold. Either way, the bad guy has Kold and can read
> Knew. If Kold is not compromised, that is, it is still a secret, then
> you can send Knew either XOR'd with Kold, or DES-Encrypted with Kold.
> It won't matter.
> 
> Remember that using SNMPv2 to update keys is going to be secure if
> and only if Kold is secure.
> 
> If you believe that Kold has been compromised then, in order to
> maintain security, you should resort to some other mechanism to
> distribute new keys (probably manual distribution). 
> 

You are assuming that we know whether or not the keys have been compromised.
A key distribution system must be secure in either case, in fact, the main
reason for a key distribution system is for when the keys have been 
compromised.  Neither of these schemes work in the case of the old key
having been compromised.

There are two reasons to change keys in a cryptographic system - 1)  The old
key has been compromised, and 2) to protect them from a 
cryptanalysis threat.  In the first case, neither the XOR scheme or using DES
with the old key will work.  In the second case, the idea is to 
limit the amount of time the
cryptanalysist has to break the keys.  When you XOR the old key with the new
key, you are providing no protection from the cryptanalysist!  The attacker 
can continue to try to break the first key and once that is accomplished, he 
can simply calculate the current key using the original key and all of the 
key update XOR values.  And if you use DES with the old key to send the new 
key, the attacker can do the same - once he has the old key he can decrypt the
key update messages to determine the new key.  So... neither of these schemes 
works in the second case.

If you don't think you need to provide protection 
from a cryptanalysist - then why change keys?  

In the proposed SNMPv2 system, the only way to provide secure key distribution
is to create a desPriv/md5Auth party that is used only to send the keys of the
other parties.  The keys of this party, however, would have to be updated
manually.

Julie Tarr
Naval Research Lab
Secure Networks Group
[phone]