Subject: RE: [midcom] WGLC - Alternatives for 'securing' STUN

From: Melinda Shore <[email-masked]>
Date: Tue, 30 Apr 2002 15:28:07 -0400

At 12:17 PM 4/30/02 -0700, Christian Huitema wrote:
>It is true that in any key-hash signature algorithm, the attacker sees
>the plain text and the hash. Using a user generated password as key
>material in this context would be very weak, since user generated
>passwords can fall to dictionary attacks. This is the reason why I
>proposed that the server provides the user with a password, which could
>well be a 128 binary string of appropriate randomness -- it does not
>have to be user friendly. It would be extremely hard to reverse this
>kind of key, even if you know the plaintext. I don't think we have to
>worry about that.

I don't think we need to worry about it with your proposal
(while acknowledging that there are some really, really terrible
random number generators out there).  We do need to worry about
it with long-lived pre-shared keys.

Melinda

_______________________________________________
midcom mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/midcom

---

From: Jonathan Rosenberg <[email-masked]>
Date: Tue, 30 Apr 2002 15:33:07 -0400

> it with long-lived pre-shared keys.

Agreed its a problem with long-lived pre-shared keys. That problem can
be mitigated using a four-way handshake:

      request
C --------------> S
   response w/ server nonce
C<-----------------S

   request w/ hash over (secret,server-nonce), client nonce
C----------------> S

   response w/ hash over (secret,client-nonce)
C<---------------- S

of course, the hashes also include the content of the message as well as
the nonce and secret. This is full mutual-auth, and is the same flow as
used by http digest for that purpose.

However, I am still confused about whether this proposal (TLS to obtain
shared secrets) solves the problems Jon raised. It does not eliminate
the need for TCP, certs, or any of the other "heavy" stuff. If you allow
for provisioned shared secrets rather than using TLS to obtain a
short-lived one, it does solve his objection of the need for PKI under
all conditions, although all servers would need to implement it for
sure...

-Jonathan R.

-- 
Jonathan D. Rosenberg, Ph.D.            72 Eagle Rock Avenue
Chief Scientist                         First Floor
dynamicsoft                             East Hanover, NJ 07936
[email-masked]                 FAX: (973) 952-5050
http://www.jdrosen.net                  PH:  (973) 952-5000
http://www.dynamicsoft.com