Subject: RE: [midcom] WGLC - Alternatives for 'securing' STUN

From: Melinda Shore <[email-masked]>
Date: Tue, 30 Apr 2002 13:39:30 -0400

At 12:11 PM 4/30/02 -0500, Sanjoy Sen wrote:
>IMO, we should have support for both the options - (1) an (out-of-band) pre-shared secret based mechanism, and (2) a TLS based shared-secret/mapping download mechanism (Huitema's proposal), with (1) being mandatory to implement and with (2) supported by servers who would accept STUN requests from unknown clients. 

Options are a generally a bad thing, and in security they can
be a very, very bad thing (_pace_ IKE).  They can lead to 
interoperability problems, negotiation-down attacks, and
increased complexity in implementation and testing.  In this 
case we don't need to worry about a negotiation-down attack, but 
we should be aware that given what this protocol does it's highly 
vulnerable to a known-plaintext attack.  That would be mitigated by, 
at a minimum, not reusing keys.

Is that important?  It may or may not be, depending on the
circumstance.  I would hope that in any deployment where security
is a high priority they're doing more at the application layer
than just passing stuff through a VPN, even though that's typically
the extent of protection in today's networks.  The level of 
protection I expect us to provide is at least sufficient protection 
to be able to hold off the vandals that typically go after Microsoft
products, and some of those people are quite sophisticated.

Melinda

_______________________________________________
midcom mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/midcom

---

From: Ted Hardie <[email-masked]>
Date: Tue, 30 Apr 2002 10:59:13 -0700

On Tue, Apr 30, 2002 at 01:39:30PM -0400, Melinda Shore wrote:
<snip>
> at a minimum, not reusing keys.

I suspect that the key will have to be reused at least through the a
set of exchanges (so that test of each of the four address/port pairs
use the same key).  If we don't allow that, the number of TLS set ups
and tear downs might be high enough (and take long enough)that there
is some risk of mappings changing.

If that is the case, is there any replay or hijack threat during
the middle of the set of exchanges?
			regards,
				Ted Hardie

---

From: Melinda Shore <[email-masked]>
Date: Tue, 30 Apr 2002 14:12:18 -0400

At 10:59 AM 4/30/02 -0700, Ted Hardie wrote:
>use the same key).  

Right, and I don't see a a problem with that.  The problem I'm
envisioning is that of an attacker watching several-to-many call
setups.  I don't think that it's necessary or even desirable to
rekey during a single phone call.

Melinda