Subject: The Confirmation of understanding of the multiple authentication attack

From: [email-masked] (Sam Hartman)
Date: Wed, 17 Mar 2004 14:53:36 -0500 (EST)

I want to confirm I'm understanding the attack described in the
section 6.3.1 of the current base spec draft.  If I understand the
attack, then I'll work with Kurt and Alexie to replace that text with
a more general security consideration.

I'd appreciate if Alexie and other parties who brought the attention
of the attack to this working group could confirm my understanding.

The client C is talking to a proxy P.

The proxy implements SASL decription and authentication services.  The
client authenticates to some service through P that is served by
server A. t 

Now most traffic goes from C to P, is decrypted and then sent over
another channel to A.

Later within the same session, the client wants to access another
resource requiring new authentication.  It reauthenticates to P, and
this new resource is on server B.

No new security layer is negotiated, so the same keys, IVs, etc are
used between P and C.

B can inject text into its channel to P, which P will encrypt for C.
B may also be able to cause C to send it certain text depending on the
protocol; this text would be encrypted to P and then later sent to B.

So it is possible that B could mount a chosen plaintext attack
potentially gaining information about the previous communications
between A and C.  

As an example, with the des mode of digest-md5, if B knows the last
block of ciphertext between P and A, B may be able to construct
plaintext to test a guess of plaintext previously communicated between
A and C.

In particular, this attack does not depend on B knowing the key used
to talk to C, nor does it assume that B is directly doing encryption.

If I'm understanding this correctly, there's a lot of complexity we
can get rid of in the current description of the attack.