Subject: Nat Traversal concern in IKEv2

From: Ricky Charlet <[email-masked]>
Date: Thu, 19 Jun 2003 16:46:42 -0700

Howdy,

	I've wound up with some extra time on my hands lately and thought I'd 
contribute some more.

So when sending NAT_DETECTION_SOURCE_IP or NAT_DETECTION_DESTINATION_IP 
these payloads contain a SHA1 hash of the IP address and port.

First of all, there is no specification as to what key to use for the 
SHA1. And this is before the DH has completed. So I see no reasonable 
choice for how to key this algorithm.

But more worrisome would be that a dictionary attack on all possible IP 
addresses with 500 and 4500 for ports would reveal the key with fairly 
light effort. So I perceive a requirement that the key used for this 
SHA1 in the NAT_DETECTION_* payloads MUST NOT be related in any way to 
the keys or key generating material used for privacy, integrity and 
authentication later. This requirement seems onerous.

So perhaps we could move the  NAT_DETECTION_SOURCE_IP and 
NAT_DETECTION_DESTINATION_IP payloads to somewhere in the protected 
portion of the IKE exchanges and just put the IP/port in the packet 
directly (not a SHA1 hash).

What do y'all think?

---
Ricky Charlet
(formerly with Sonciwall and before that formerly with Redcreek)
[email-masked]
510.324.3163

---

From: Ricky Charlet <[email-masked]>
Date: Thu, 19 Jun 2003 18:06:23 -0700

On Thursday, June 19, 2003, at 04:46 PM, Ricky Charlet wrote:

> So when sending NAT_DETECTION_SOURCE_IP or 
> NAT_DETECTION_DESTINATION_IP these payloads contain a SHA1 hash of the 
> IP address and port.
>
> But more worrisome would be that a dictionary attack on all possible 
> IP addresses with 500 and 4500 for ports would reveal the key with 
> fairly light effort. So I perceive a requirement that the key used for 
> this SHA1 in the NAT_DETECTION_* payloads MUST NOT be related in any 
> way to the keys or key generating material used for privacy, integrity 
> and authentication later. This requirement seems onerous.
>

oops. Just a bit more thinking about the matter and I realized that 
knowing the 8 billion possible plain texts does not constitute a 
dictionary attack on the secret. And probably does not give much value 
to an attacker trying to recover the key.

But, still, what key to use? And why not put this under the protected 
IKE exchanges?

---
Ricky Charlet

---

From: Francis Dupont <[email-masked]>
Date: Fri, 20 Jun 2003 16:03:53 +0200

In your previous mail you wrote:

                                 ^^^^

=> please note this is a plain hash.
   
   So I perceive a requirement that the key used for this 
   SHA1 in the NAT_DETECTION_* payloads MUST NOT be related in any way to 
   the keys or key generating material used for privacy, integrity and 
   authentication later. This requirement seems onerous.
   
=> as there is no such key the requirement is fulfilled.

=> this should give another useful but different property: protection
of the peer addresses and ports...

Regards

[email-masked]