Subject: RE: Comments on draft-ietf-dhc-aaa-ra-00.txt

From: George Tsirtsis <[email-masked]>
Date: Tue, 6 Feb 2001 05:09:43 -0500

-----Original Message-----
From: Subir Das [mailto:[email-masked]]
Sent: Tuesday, February 06, 2001 12:33 AM
To: DHCPv4 discussion list
Cc: Erik Nordmark; DHCPv4 discussion list; [email-masked]
Subject: Re: Comments on draft-ietf-dhc-aaa-ra-00.txt

...

>
>
> >Otherwise an unauthenticated entity can just spoof its IP address to be
> that
> >of an already authenticated entity and gain access.
>
> That's why authenticated DHCP isn't an access control mechanism ;)

   This is my understanding too.

GT> Lets get this straight. If AAA is triggered at the DHCP RA as I suggest
then an attacker would have to spoof IP AND MAC addresses...which I think is
a bit harder....Furthermore, unless we get per packet/frame authentication
anything can be spoofed...so while DHCP is not an access control mechanism
today, it can certainly be made to be...

> But the need to link BURP to DHCP is far from clear.

Is it necessary to link BURP to DHCP while we have multiple approaches
(IPv4 autoconfiguration, IPv6 stateless autocnfiguration) to configure a
host
in absence of DHCP?

GT> Now this is a good point, and that is why I am in favor of a generic
(non-DHCP, non-802, non-anything) L3 access control/authentication mechanism
if it can be made to work despite my own proposal regarding DHCP.

George

---

From: Erik Nordmark <[email-masked]>
Date: Wed, 7 Feb 2001 12:49:36 +0100 (CET)

> today, it can certainly be made to be...

802.1X does per-port access control (great for switched Ethernets)
and has some laguage (which I don't quite understand) about tying the access
control to 802.11 per-station encryption with per-station keys.
[The reason I don't quite understand it is because I thought 802.11 was
using a single shared key for all the stations.]

Thus 802.1X is an existence proof of an access control mechanism
that is more fine grained than what you could ever do at L3 whether
in a DHCP relay or somewhere else.

   Erik

---

From: Bill Sommerfeld <[email-masked]>
Date: Wed, 07 Feb 2001 14:53:37 -0500

> using a single shared key for all the stations.]

That's certainly how all the 802.11 boxes i've played with operate,
and pretty much how an ad-hoc 802.11 LAN has to operate in the absence
of a key management protocol known to the end stations.

However, in "infrastructure" mode, all unicast traffic is sent between
the wireless node and the access point it's associated with, so it
would be relatively straightforward to have per-node keys as long as
there was a key-distribution infrastructure in place to distribute all
the per-node keys amongst all the base stations -- just makes for more
work at the access point.. clients might be completely unaware of
this.

Multicast would get "interesting", though.  I'd imagine that an AP
would have to transmit N copies -- one for each of the N different
keys; an alternative would be to continue to have a network key and
use that to protect multicast.

---

From: "Bernard Aboba" <[email-masked]>
Date: Thu, 8 Feb 2001 00:35:46 -0800

>using a single shared key for all the stations.]

Actually, 802.11 supports per-session unicast keys as well as several
global multicast keys. However, the initial implementations did not have
enough on-chip memory to store all the per-session unicast keys, so
that they only supported global multicast keying. The newer chipsets 
correct this problem.

---

From: Peter Thomas <[email-masked]>
Date: Fri, 09 Feb 2001 11:01:35 -0500

Do any of you have an opinion on whether the recently published WEP passive and active plaintext recovery and alteration vulnerabilities impact implementations of DHCPv4 (or 6) in wireless LANs?

--Pete
-----
Peter L. Thomas, System Architect
Global Command and Control System - Army

+1 (703)813-2684
[email-masked]

---

From: John Schnizlein <[email-masked]>
Date: Fri, 09 Feb 2001 11:59:50 -0500

Pete,

Yes, if you mean the results reported here:
http://www.isaac.cs.berkeley.edu/isaac/wep-faq.html
The passive attack exploits the relative lack of entropy (repeating
sequence of the random pattern used in the stream cypher) in the WEP 
encryption. The active attack exploits the symmetry (XOR) of the
encryption/decryption.

Recall that DHCP works on old-fashioned coax multi-access networks
with the same (lack of) privacy as broadcast radio (if you tap the wire).

It is possible to mitigate the problem demonstrated in the above report
by using different WEP keys for each session, rather than a shared key.
Per-session keys are facilitated by the 802.1x authentication, which is
possible with 802.11 wireless LANs. 

As has been pointed out before, access control works at layer two.

John

At 11:01 AM 02/09/2001 -0500, Peter Thomas wrote:
>Do any of you have an opinion on whether the recently published WEP 
>passive and active plaintext recovery and alteration vulnerabilities 
>impact implementations of DHCPv4 (or 6) in wireless LANs?

---

From: Peter Thomas <[email-masked]>
Date: Fri, 09 Feb 2001 12:16:47 -0500

John, thanks for your thoughts.  That was indeed the precise report I was referring to (and I apologize for being too slack to dig through my archives and pull out the link myself).  Thinking back on the draft, all the relayed AAA traffic was (presumably) happening on the back-end wired (as opposed to the client, possibly wireless) network media.  I disagree, however, that physically a tapped physical medium is equivalent to a remotely tapped wireless medium--especially one which you were led to believe (prior to the publication of this vulnerability) was secure.

I'm not sure how per-session key negotiation negates this attack--considering the potentially large number of sessions that are opened, deciphering the key stream from a search space of (recognizable?) key negotiation transactions seems possible (just more time consuming).

I don't want to risk wandering too far afield from the subject draft here, so feel free to close the loop on this or let it drop as you choose.

-Pete
-----

+1 (703)813-2684
[email-masked]

  ----- Original Message ----- 
  From: John Schnizlein 
  To: [email-masked] 
  Cc: DHCPv4 discussion list 
  Sent: Friday, February 09, 2001 11:59 AM
  Subject: Re: Comments on draft-ietf-dhc-aaa-ra-00.txt

  Pete,

  John

---

From: "Bernard Aboba" <[email-masked]>
Date: Sat, 10 Feb 2001 07:06:14 -0800

> I'm not sure how per-session key negotiation negates this
attack--considering the potentially large number of sessions that are
opened, deciphering the key stream
> from a search space of (recognizable?) key negotiation transactions seems
possible (just more time consuming).

Rather than taking this mailing list into completely unrelated topics, have
a look at the following references:

http://www.drizzle.com/~aboba/IEEE/1-18.zip
http://www.drizzle.com/~aboba/IEEE/baseline.ppt.gz
http://www.drizzle.com/~aboba/IEEE/8021x-d10.pdf.gz