Re: SNMPv2 security

[Julie Tarr <[e-mail]>]

> 
> > There are two reasons to change keys in a cryptographic system - 1)  The old
> > key has been compromised, and 2) to protect them from a 
> > cryptanalysis threat.
> 
> In SNMPv2, there is a third reason: to allow the clock to be reset without
> allowing all previous messages to be replayed.
> 
> The "linear" (as someone else called it) change of XOR-ing the keys can
> have two impacts:
> 
> 1. it doesn't make the cryptanalyst's job any easier, it could make no 
> difference, or (my guess) it could make it at least a little harder,
> although the amount by which it is harder may be negligible, I don't know.
> 
> 2. without the XOR, the cryptanalyst can work from any subset of the
> messages; with XORs, the cryptanalyst must capture all the packets
> to/from that agent, inspect them all for a) SetRequests which modify
> partyAuthPriv, and b) the matching Response messages to make sure that
> the identified SetRequests were successful, etc., and then factor the
> changes into the calculations.  Wouldn't you say that make the job a
> bit harder ?
> 
In order for the cryptanalysis to have the data to crack the keys, he must
already selectively capture traffic going to/from that agent.  The XOR scheme
does not make his job significantly harder.  It gives him unlimited time
in which to crack the code.

Also note that, as someone else in this discussion group has already pointed out,
the XORed key change message is vulnerable to replay attack.  If an attacker replays
a key change message within the window of oppportunity provided by the message lifetime,
then the replayed message will change the keys back to the old key.  That is,
the manager sends to the agent (Kold XOR Knew) . The agent calculates 
Kold XOR (Kold XOR Knew) to produce Knew and changes its key to Knew.  If the
agent receives a replay of this key change message, it will calculate 
Knew XOR (Kold XOR Knew) to produce Kold and change the key back to Kold.  The 
agent will send a confirmation of this change back to the manager, so the manager
will be aware that an attacker has tampered with the system.  However, how is 
the manager going to reset the key?  If it tries to send another XOR key change
message, the attacker can simply repeat this procedure.

Note that this replay attack is relatively simply to perform, it only requires
good timing.

				Julie