Subject: [BEHAVE] use of NONCE in draft-ietf-behave-rfc3489bis-05

From: Brian Hibbard <[email-masked]>
Date: Sat, 18 Nov 2006 13:07:17 -0600

Use of NONCE is mandatory with long-term credentials, but not with 
short-term credentials, where it's use is optional.   From sec 9.1.1

     If the NONCE was absent and the server is authenticating
     with short term credentials, the server MAY generate an error
     response with an ERROR-CODE attribute with a response code of 435
     (Missing Nonce).

Unless I'm missing something, it seems to me it would be better if the 
server SHOULD or MUST use NONCE for short-term secrets as well.

If I understand properly, the reasoning behind not using NONCE with 
short-term secrets is that their validity is already constrained 
temporally by being short-term and this provides adequate protection 
from password cracking.

However, I don't see how that would stop an attacker who is capable of 
mounting a replay attack using requests (especially  STUN Relay Allocate 
Requests)  that are authenticated with a short-term secret.  
MESSAGE-INTEGRITY doesn't include any fields from IP, TCP, or UDP.   
Also, there is verbage discussing how the short-term secret might be 
formulated in the server that suggests using the sender's IP, but there 
is nothing that suggests that the server validate the username/password 
using that same mechanism (which would be cumbersome) for all subsequent 
messages authenticated with that credential.  Even considering that the 
credential expires after some time, the attacker could still wait for 
the victim  to acquire a new secret and send new messages with it, which 
the attacker could also replay.

There are things a server could do outside what the draft discusses to 
protect against replay attacks against short-term secrets, but requiring 
NONCE would probably be simplest.

_______________________________________________
Behave mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/behave

---

From: Jonathan Rosenberg <[email-masked]>
Date: Tue, 21 Nov 2006 17:18:07 -0500

We can't require nonces, since this would basically kill the primary 
usage of short term credentials these days - ICE itself. Running a 
challenge response on every ICE connectivity check would double the 
network traffic for it and double the ICE setup delays.

In the case of ICE in particular, the challenge won't add any security 
benefits. The security considerations section walks through this. Replay 
attacks don't work because of the reverse connectivity check that takes 
place. Since the transaction ID changes, the attacker could not respond 
to the reverse connectivity check without the shared secret, and thus 
any IP address suggested by the attacker will fail validation.

So, I think it is still MAY, but perhaps a few more words are needed to 
clarify that usages should carefully consider replay attacks if not 
using a nonce.

-Jonathan R.

-- 
Jonathan D. Rosenberg, Ph.D.                   600 Lanidex Plaza
Cisco Fellow                                   Parsippany, NJ 07054-2711
Cisco Systems
[email-masked]                              FAX:   (973) 952-5050
http://www.jdrosen.net                         PHONE: (973) 952-5000
http://www.cisco.com