Subject: [Hipsec] RFC5201 Ticket #32:

From: Tobias Heer <[email-masked]>
Date: Fri, 23 Sep 2011 17:22:23 +0200

Hello,

I did a literature search and the only problem I found was the "small subroup"
attack.

The attack is described in RFC2785 (http://tools.ietf.org/html/rfc2785) and was
recently brought up again in [1].

The issue is that an attacker (Initiator) can use a DH key with a smaller
subgroup. This makes finding the private key easier if this process can be
repeated (the Initiator repeats this procedure with different keys for the same
Responder key). Therefore, using a static Responder key can create
vulnerabilities against this attack.

As described in RFC2785 and [1], validating the Initiator key according to
RFC2631 (http://tools.ietf.org/html/rfc2631#section-2.1.5) avoids this issue.
The validation process is simple: "

1. Verify that y lies within the interval [2,p-1]. If it does not,
	the key is invalid.
2. Compute y^q mod p. If the result == 1, the key is valid.
	Otherwise the key is invalid.

"[RFC2785]

TLS (RFC5246) addresses the very same issue by stating:
   "If the same DH keypair is to be used for multiple handshakes, either because
   the client or server has a certificate containing a fixed DH keypair or
   because the server is reusing DH keys, care must be taken to prevent small
   subgroup attacks. Implementations SHOULD follow the guidelines found in
   [SUBGROUP]." [SUBGROUP] = [RFC2785].

I propose to add a similar wording to the text passage in RFC5201-bis that
discusses repeated use of the Responder's DH key.

############### Text for RFC5201-bis ###############
"If the Responder uses the same DH keypair for multiple handshakes. It must
take care to avoid small subgroup attacks [RFC2785]. To avoid these attacks,
when receiving the I2 message, the Responder SHOULD validate the Initiators DH
public key as described in [RFC2785] Section 3.1. In case the validation fails,
the Responder MUST NOT generate a DH shared key and MUST silently abort the HIP
BEX."
############### /Text for RFC5201-bis ###############

Do you have comments or suggestions?

Cheers!

Tobias

References: [1] Alfred Menezes and Berkant Ustaoglu. "On reusing ephemeral keys
in Diffie-Hellman key agreement protocols". International Journal of Applied
Cryptography (January 2010), pp. 154-158.

-- 
Dipl.-Inform. Tobias Heer, Ph.D. Student
Chair of Communication and Distributed Systems - comsys
RWTH Aachen University, Germany
tel: +49 241 80 207 76
web: http://www.comsys.rwth-aachen.de/team/tobias-heer/
blog: http://dtobi.wordpress.com/
card: http://card.ly/dtobi
pgp id: AEECA5BF

---

From: Tobias Heer <[email-masked]>
Date: Sat, 24 Sep 2011 01:05:32 +0200

Sorry, I just realized that the previous mail was missing an important part: the problem description.

Here is the description from the tracker:

Issue 33: reusing DH public values
http://trac.tools.ietf.org/wg/hip/trac/ticket/33
----------------------------------------------------------------

5201 states in the R1 processing section, regarding DH reuse:
" If a future version of this protocol is considered, we strongly
recommend that these issues be studied again."
Has this issue been studied again? Should this text be replaced?

----------------------------------------------------------------

Anfang der weitergeleiteten E-Mail:

> Von: Tobias Heer <[email-masked]>
> Datum: 23. September 2011 17:22:23 MESZ
> An: HIP <[email-masked]>
> Betreff: [Hipsec] RFC5201 Ticket #32:
> 
> Hello,
> 
> _______________________________________________
> Hipsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/hipsec