Subject: [manet] DLEP-17: "Use TLS" flag is not secure

From: RJ Atkinson <[email-masked]>
Date: Tue, 24 Nov 2015 10:20:26 -0500

Section 10.2, page 38 (top) defines a “Use TLS” flag.

This design creates a security problem.  The issue is commonly
known as a “downgrade attack”, because a man-in-the-middle
attacker (whether on-link or off-link) simply clears that bit
to (incorrectly) indicate that TLS is not required.

I don’t see any way to fix this, but I am open-minded 
if someone has a creative idea.

The absolute bare minimum for IETF approval would be that this
(easily exploited) vulnerability be disclosed BOTH within 
Section 10.2 AND also in the Security Considerations of Section 11.

My guess is that the Security Area reviewer will say that this
is unacceptable protocol design.  

So I’d prefer (and recommend) that we drop this “Use TLS” flag.

Maybe an alternate approach would be to create an informative
status code or signal (whichever) that a peer could send to
a would-be peer to indicate that non-TLS DLEP sessions are not
allowed.  

While that proposed message could be intercepted/dropped by
an adversary, it is purely a status message. A good DLEP
implementation would attempt a DLEP+TLS session with its 
intended peer anytime a DLEP w/o TLS session failed, so
the loss of the proposed message doesn’t create a security
vulnerability.

Yours,

Ran

---

From: Henning Rogge <[email-masked]>
Date: Tue, 24 Nov 2015 16:31:14 +0100

> to (incorrectly) indicate that TLS is not required.

The TLS bit is (I think) not about "use TLS" or "don't use TLS", its
just the bit that tells you what to expect on the IP/port combination.

If you clear the bit, the other side would try to connect to the TLS
socket with a default TCP connection, which will fail.

> the loss of the proposed message doesn’t create a security

I don't think there is any way between two parties that don't know
each other to establish a secure connection if BOTH of them support
non-secure communication AND a Man in the Middle controls all traffic
between the two parties.

The MITM could just drop everything that is security-related from the
communication.

Henning Rogge

---

From: Rick Taylor <[email-masked]>
Date: Tue, 24 Nov 2015 16:04:58 +0000

Hi Ran,

Thanks for the on-going reviews.  I'll quickly comment on this one.

Henning is right, the 'Use-TLS' flag means "TLS is expected when using 
this connection point (address:port)".  Perhaps 'Expect-TLS' would be a 
better name for the flag?

Cheers,

Rick

On 24/11/15 15:31, Henning Rogge wrote:
> _______________________________________________
> manet mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/manet
>

---

From: RJ Atkinson <[email-masked]>
Date: Tue, 24 Nov 2015 12:57:58 -0500

> On 24  Nov 2015, at 10:31 , Henning Rogge <[email-masked]> wrote:
> 

Please edit the draft to say this — possibly even use the words above.
That meaning is not clear right now.

> The MITM could just drop everything that is security-related from the

That text seems to say the DLEP session would fail due to the described
DOS attack.  If that is the consensus answer, then please put the text 
above (or equivalent text discussing the TLS flag) into the DLEP
Security Considerations section.  

Basically, the DLEP Security Considerations section ought to 
at least document all known security vulnerabilities (not just off-link
vulnerabilities) and suggest remedies for the vulnerabilities.

Yours,

Ran

---

From: RJ Atkinson <[email-masked]>
Date: Tue, 24 Nov 2015 12:59:09 -0500

> On 24  Nov 2015, at 11:04 , Rick Taylor <[email-masked]> wrote:
> 
> Hi Ran,
> 

It might be simpler and clearer to copy/paste Henning’s text from his 
email (edit to taste) into the section that specifies that flag.

Ran