Subject: [NSIS] Security Threats for NSIS: Unprotected Authorization Information

From: Tschofenig Hannes <[email-masked]>
Date: Thu, 15 Apr 2004 15:45:16 +0200

hi all, 

a comment related to the authorization information:

> 4.5 Unprotected Authorization Information 
>     
>    Returning an unprotected authorization token to 
>    the end host might allow an adversary (for example an eavesdropper) 
>    to steal resources. An adversary might also use the token to monitor 
>    communication patterns. Finally, an untrustworthy end host might 
>    also modify the token content.  

> Doesn't this just mean that the token passing protocol is broken?
> (i.e. shouldn't we be able to avoid this happening by using strong
> protocols? or are these protocols particularly hard to secure?)

it depends what you call broken. it might work in some environments and it
depends on some assumptions. people often propose it (and we also included
the possibility for it in the qos nslp since it is applicable to the 3gpp).

it is necessary to protect the token itself to avoid people to create their
own tokens. this, however, does not protect someone stealing your token
which flies over the air interface (without additional protection).

ciao
hannes

_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis