Subject: [Hipsec] changes to base spec?

From: Andrei Gurtov <[email-masked]>
Date: Mon, 25 Apr 2005 09:58:18 +0300

Hi,

Tuomas and Aarthi wrote a paper on the Analysis of the HIP Base Exchange 
Protocol that will appear in ACISP'05, July 2005.
http://www.cs.helsinki.fi/u/gurtov/papers/analysis_hip.pdf

They suggest several changes to the HIP specs for improving security. Do 
you think we should adopt any of the changes for the base spec?

Andrei

The more interesting security properties in the HIP base exchange relate to
denial-of-service: the protocol uses client puzzles with several novel 
details to protect
against resource-exhaustion DoS attacks. We showed that these details 
require
modification to provide the intended protection. In particular, an 
attacker was able
trick the honest Initiator into solving the wrong puzzles, and it was 
able to consume
the puzzles of the honest Initiator by solving them first. Moreover, the 
protocol state
machine requires changes to prevent deadlocks and livelocks.

Our analysis of the abstract protocol complements in an important way the
detailed protocol design, specification, implementation, and testing 
that happens
during the IETF standardization process. It should be remembered that 
HIP is as
much a multi-addressing and mobility protocol as a security protocol. We 
suggested
solutions to all the discovered problems and believe that the proposed 
protocol
changes fit well into the HIP framework without compromising its 
original goals.
_______________________________________________
Hipsec mailing list
[email-masked]
http://honor.trusecure.com/mailman/listinfo/hipsec

---

From: Julien Laganier <[email-masked]>
Date: Mon, 25 Apr 2005 13:09:44 +0200

Hi Andrei,

On Monday 25 April 2005 08:58, Andrei Gurtov wrote:
> Hi,
>
> Tuomas and Aarthi wrote a paper on the Analysis of the HIP Base
> Exchange Protocol that will appear in ACISP'05, July 2005.
> They suggest several changes to the HIP specs for improving
> security. Do you think we should adopt any of the changes for the
> base spec?

I quickly went throughout the paper, and here's my first impressions:

- Parts 3, 4, 5 and 7 (resp. replays of R1s, reuse of D-H keys, puzzle 
implementation, state machine issues) seems sensible to me. IMHO we 
should adopt them after a carefull review (I'll try to understand 
further the consequences of the modifications).

- Parts 6 (initiator identity protections) seems more problematic to 
me. I don't fully agree with the argument that "encryption is 
ineffective as a privacy mechanism". While it's true that the current 
spec is somewhat vulnerable to tracking of cleartext HIT anyway, I 
would like to keep the door open for integrating into HIP Jukka and 
Pekka's BLIND proposal [1] for complete end-point identity 
protection.

Thanks,

--julien

[1] Jukka Ylitalo, and Pekka Nikander, "BLIND: A Complete Identity 
Protection Framework for End-points", (to appear) in Proc. of the 
Twelfth International Workshop on Security Protocols, Cambridge, GB, 
April 26-28, 2004. 
_______________________________________________
Hipsec mailing list
[email-masked]
http://honor.trusecure.com/mailman/listinfo/hipsec

---

From: Andrei Gurtov <[email-masked]>
Date: Wed, 27 Apr 2005 09:15:05 +0300

Hi,

Thanks for feedback. I've also privately discussed the changes with 
Kristian Slavov @ NomadicLab. He seems to agree with them, except noting 
that HIT is not provably identifying the host (however with 128 bits the 
probability of getting a collision is negligible).

Andrei

---

From: Pekka Nikander <[email-masked]>
Date: Thu, 28 Apr 2005 09:39:26 +0300

> Pekka's BLIND proposal [1] for complete end-point identity

I don't have a firm opinion (too busy to form one), but I just want
to make the remark that BLIND requires also other changes to the
base, essentially creating a variant of the base exchange.  Hence,
I would not consider BLIND as a reason for not adopting Tuomas'es
suggestion.

--Pekka