Subject: [Hipsec] rethought I2 and HMAC

From: Tobias Heer <[email-masked]>
Date: Sat, 15 Jul 2006 22:33:16 +0200

Hi everyone!

I was thinking about the HMAC in the I2 packet again.

The reason why it could be there to protect the RSA operation in case
that the senders HI was encrypted. In that case the DH shared secret
would have to be created anyway. Checking the HMAC would prove that the
initiator has actually computed the DH shared key (otherwise it can't
sign the packet with the HMAC). This would mitigate DoS attacks with
faked initiator DH public values and encrypted HIs. In such a case, the
DH computation would be done but the fake DH key would be realized by
the failure of the HMAC verification. The responder can throw the packet
away and save the time for the RSA verification.

Seems a bit constructed to me but it makes sense somehow. Was this the
reason that the HMAC is there?

Thanks for answers and clues.

Tobi

_______________________________________________
Hipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/hipsec

---

From: "Henderson, Thomas R" <[email-masked]>
Date: Mon, 17 Jul 2006 06:47:40 -0700

> -----Original Message-----
> From: Tobias Heer [mailto:[email-masked]] 
> Sent: Saturday, July 15, 2006 1:33 PM
> To: [email-masked]
> Subject: [Hipsec] rethought I2 and HMAC
> 
> Hi everyone!
> 

I believe that the HMAC was added based on a email suggestion by Yogesh
Swami in a Sept 2004 posting to the Hipsec list.  This message is no
longer at Trusecure archive (have we lost the public posting of this WG
archive?), but can be found in Google cache by Googling "HIP I2 HMAC".
There is no rationale given in that message but I believe that it was
for the reason you cite.

Tom

---

From: Julien Laganier <[email-masked]>
Date: Mon, 17 Jul 2006 16:02:25 +0200

On Monday 17 July 2006 15:47, Henderson, Thomas R wrote:
> > The reason why it could be there to protect the RSA operation in
> > case that the senders HI was encrypted. In that case the DH
> > shared secret would have to be created anyway. Checking the HMAC
> > would prove that the
> > initiator has actually computed the DH shared key (otherwise it
> > can't sign the packet with the HMAC). This would mitigate DoS
> > attacks with faked initiator DH public values and encrypted HIs.
> > In such a case, the
> > DH computation would be done but the fake DH key would be
> > realized by the failure of the HMAC verification. The responder
> > can throw the packet
> > Seems a bit constructed to me but it makes sense somehow. Was
> > this the reason that the HMAC is there?
>
> I believe that the HMAC was added based on a email suggestion by
> Yogesh Swami in a Sept 2004 posting to the Hipsec list.  This
> message is no longer at Trusecure archive (have we lost the public
> posting of this WG archive?), but can be found in Google cache by
> Googling "HIP I2 HMAC". There is no rationale given in that message
> but I believe that it was for the reason you cite.

IIRC the HMAC is there so that HIP follows the SIGMA guidelines 
suggested by Hugo Krawczyk. See:

Hugo Krawczyk. SIGMA: the 'SIGn-and-MAc' approach to authenticated 
diffie-hellman and its use in the IKE protocols. In D. Boneh, editor, 
Advances in Cryptology -- CRYPTO 2003.

--julien