Subject: [NSIS] Security Threats for NSIS : Insecure Parameter Exchange and Negot iation

From: Tschofenig Hannes <[email-masked]>
Date: Thu, 15 Apr 2004 15:45:06 +0200

hi all, 

> 3.4 Insecure Parameter Exchange and Negotiation

> I think this threat is very important to consider. But is there
> any way to handle it except in the context of a security protocol
> (unless you rely on static policies)? You can always mount a 
> downgrading attack on the authentication process itself, at 
> which point you are finished.

yes. typically one has to repeat the parameters again after a security
association has been established. 
if the weakest mechanism is resistant against a real-time attack (i.e., a
cryptomechanism which can be broken in realtime before the negotiation is
completed) then the modification will be discovered. 

you can find an example of this in: 
http://www.ietf.org/rfc/rfc3329.txt

ciao
hannes

_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis