Subject: RE: [AVT] RFC 3711 Key Derivation

From: Vavilapalli Srikanth-A19563 <[email-masked]>
Date: Mon, 29 Nov 2004 11:58:01 +0530

Idan

I think the initial sequence number (SEQ) and ROC of the session must be
communicated to the other participants in the case non-zero key derivation
rate using some out-of-band signaling. 

If not (i.e. if SEQ number is not communicated), even the integrity
protection also can not avoid the out of sync issues. The integrity
protection helps the receiver to drop the attacker's packet, but also makes
receiver to drop the actual sender's packets, because receiver uses
different session key than the sender's. 

Regards
Srikanth

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Mark
Baugher
Sent: Monday, November 29, 2004 4:08 AM
To: Ofer Idan
Cc: Yuval Nissan; [email-masked]
Subject: Re: [AVT] RFC 3711 Key Derivation

hi
On Nov 28, 2004, at 12:33 AM, Ofer Idan wrote:

> Hi,
>
>  
>
> I have a question regarding RFC 3711 Key derivation rate.
>
>  
>
> In section 3.3 the decrypt process is described:
>
>  
>
> Bullet (4) says to determine the session keys using the maser key,  
> master salt, key derivation rate.
>
> Bullet (5) says to check for anti reply, verify authentication.
>
>  
>
> I think that there might be a problem here.
>
>   
>
> Consider a scenario where Key derivation rate is supported (different  
> than zero).
>
>  
>
> An attacker can send a packet with a higher sequence number that will  
> cause the receiver to change his session keys (according to key  
> derivation rate).

The attacker's packet won't verify upon receipt when the session is  
integrity protected and will be rejected.  (Hence the importance of  
integrity protection).

Mark
>
> From this moment on, the two sides will be unsynchronized and the  
> conversation will end.
>
>  
>
> Therefore I think that before updating the session keys the receiver  
> must first verify the message (and the sequence number) and only if  
> verified he should update all the keys.
>
>  
>
> Further more;
>
> I think that when supporting key derivation rate, authentication must  
> be applied. (otherwise the receiver is vulnerable to such attack)
>
>  
>
> What do you think ?
>
> ------------------
>
> Regards,
>
> Ofer Idan
>
> Audio Codes
>
>  
>
> *********************************************************************** 
> *************************************
> This email and any files transmitted with it are confidential material.
> They are intended solely for the use of the designated individual or  
> entity to whom they are addressed.
> If the reader of this message is not the intended recipient,
> you are hereby notified that any dissemination,use,
> distribution or copying of this communication is strictly prohibited  
> and may be unlawful.
>
> If you have received this email in error please notify  
> [email-masked] and permanently delete the e-mail and files.
>
>
> *********************************************************************** 
> ************************************
> _______________________________________________
> Audio/Video Transport Working Group
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/avt

_______________________________________________
Audio/Video Transport Working Group
[email-masked]
https://www1.ietf.org/mailman/listinfo/avt

_______________________________________________
Audio/Video Transport Working Group
[email-masked]
https://www1.ietf.org/mailman/listinfo/avt

---

From: Mark Baugher <[email-masked]>
Date: Mon, 29 Nov 2004 09:41:46 -0800

hi

> rate using some out-of-band signaling.

I hope it's not necessary to communicate the SEQ, which is a
very difficult thing to signal OOB.  Signaling the ROC for ongoing
sessions is bad enough.  The signaling layer typically does not have
access to this sort of state information.
> different session key than the sender's.

The value of the SEQ in the validated packet with the ROC are enough  
information
to identify and calculate the correct key (the SEQ is not encrypted so  
the
receiver can determine the key to use).  What am I missing?

Mark