Subject: [AVT] RFC 3711 Key Derivation

From: "Ofer Idan" <[email-masked]>
Date: Sun, 28 Nov 2004 10:33:44 +0200

Hi,

I have a question regarding RFC 3711 Key derivation rate.

In section 3.3 the decrypt process is described:

Bullet (4) says to determine the session keys using the maser key,
master salt, key derivation rate.

Bullet (5) says to check for anti reply, verify authentication.

I think that there might be a problem here.

Consider a scenario where Key derivation rate is supported (different
than zero).

An attacker can send a packet with a higher sequence number that will
cause the receiver to change his session keys (according to key
derivation rate).

>From this moment on, the two sides will be unsynchronized and the
conversation will end.

Therefore I think that before updating the session keys the receiver
must first verify the message (and the sequence number) and only if
verified he should update all the keys.

Further more;

I think that when supporting key derivation rate, authentication must be
applied. (otherwise the receiver is vulnerable to such attack)

What do you think ?

------------------

Regards,

Ofer Idan

Audio Codes

************************************************************************************************************
This email and any files transmitted with it are confidential material.
They are intended solely for the use of the designated individual or entity to whom they are addressed.
If the reader of this message is not the intended recipient,
you are hereby notified that any dissemination,use,
distribution or copying of this communication is strictly prohibited and may be unlawful.

If you have received this email in error please notify [email-masked] and permanently delete the e-mail and files.

***********************************************************************************************************

_______________________________________________
Audio/Video Transport Working Group
[email-masked]
https://www1.ietf.org/mailman/listinfo/avt

---

From: Mark Baugher <[email-masked]>
Date: Sun, 28 Nov 2004 14:37:35 -0800

hi

> cause the receiver to change his session keys (according to key  

The attacker's packet won't verify upon receipt when the session is  
integrity protected and will be rejected.  (Hence the importance of  
integrity protection).

Mark
> I think that when supporting key derivation rate, authentication must  
> be applied. (otherwise the receiver is vulnerable to such attack)
>
>  
>
> What do you think ?
>
> ------------------
>
> Regards,
>
> Ofer Idan
>
> Audio Codes
>
>  
>
> If you have received this email in error please notify  
> [email-masked] and permanently delete the e-mail and files.
>
>

---

From: Mats Näslund <[email-masked]>
Date: Mon, 29 Nov 2004 10:36:37 +0100

Hi Ofer,

> cause the receiver to change his session keys (according to key 

Yes, they will be changed when processing *this* packet.

>  From this moment on, the two sides will be unsynchronized and the 

This is not entirely true. As soon as a "correct" packet arrives,
the receiver will update his keys back to the correct value again.

> verified he should update all the keys.

I would put it differently: for each packet received, the receiver
needs to determine whether key update is needed ot not. This holds
also when no attacker is present: re-ordering of packets could
occur anyway.

> applied. (otherwise the receiver is vulnerable to such attack)

Authentication should always be used.

Best,

/Mats