Subject: replay attack on interim AH?

From: Euchner Martin <[email-masked]>
Date: Fri, 2 Feb 2001 16:43:28 +0100

Hi Megaco security experts,

In the Megaco/H.248 description the security is considered by  requiring the usage of IPSec when the underlying operating system  and the transport network support IPSec. In any other case the  interim authentication header AH shall be used. The header fields in the interim AH are exactly those of the SPI, SEQUENCE NUMBER and DATA fields as defined in RFC2402. As such H.248-interimAH looks very similar to IPSEC-AH.

In the Megaco/H.248 description possible attacks to a connection  using interim AH are mentioned. Eavesdropping is quite clear since the transmitted messages are send as plain text.

What is the reason that replay is mentioned as possible attack?

Does it come from a (not stated) assumption, that manual key management is used and therefor the replay protection scheme cannot be used? (this would be true as the sequence number in  the AH field may overrun and re-keying is not possible with manual  key management).

Kind Regards

Martin Euchner.
-----------------------------------------------------------------------
| Dipl.-Inf.                     Phone: +49 89 722 55790
| Martin Euchner                 Fax  : +49 89 722 46841
| Siemens AG
| ICN M NT 5                     mailto:[email-masked] <mailto:[email-masked]>
|                                mailto:[email-masked] <mailto:[email-masked]>
| Hofmannstr. 51                 Intranet: http://intranet.icn.siemens.de/marketing/network_technology/security/pki.htm
| D-81359 Muenchen               Internet: http://www.siemens.de <http://www.siemens.de>
| __________________
| Germany
-----------------------------------------------------------------------

---

From: "Rosen, Brian" <[email-masked]>
Date: Fri, 2 Feb 2001 10:57:23 -0500

Yes, since the interim AH does not use IKE, only manual keys
are feasible, and thus you could get a replay attack.

Brian

> -----Original Message-----
> From: Euchner Martin [mailto:[email-masked]]
> Sent: Friday, February 02, 2001 10:43 AM
> To: [email-masked]
> Subject: replay attack on interim AH?
>
>
> In the Megaco/H.248 description the security is considered by
>  requiring the usage of IPSec when the underlying operating
> system  and the transport network support IPSec. In any other
> case the  interim authentication header AH shall be used. The
> header fields in the interim AH are exactly those of the SPI,
> SEQUENCE NUMBER and DATA fields as defined in RFC2402. As
> such H.248-interimAH looks very similar to IPSEC-AH.
>
> In the Megaco/H.248 description possible attacks to a
> connection  using interim AH are mentioned. Eavesdropping is
> quite clear since the transmitted messages are send as plain text.
>
> Does it come from a (not stated) assumption, that manual key
> management is used and therefor the replay protection scheme
> cannot be used? (this would be true as the sequence number in
>  the AH field may overrun and re-keying is not possible with
> manual  key management).
>
>
> Kind Regards
>
> Martin Euchner.
> | ICN M NT 5
mailto:[email-masked] <mailto:[email-masked]>
|                                mailto:[email-masked]
<mailto:[email-masked]>
| Hofmannstr. 51                 Intranet:
http://intranet.icn.siemens.de/marketing/network_technology/security/pki.htm
| D-81359 Muenchen               Internet: http://www.siemens.de
<http://www.siemens.de>
| __________________
| Germany
-----------------------------------------------------------------------

---

From: Matt Holdrege <[email-masked]>
Date: Fri, 2 Feb 2001 15:30:24 -0800

Brian,

I thought you said in an earlier mail that the Interim AH scheme was for
all intents and purposes, deprecated.

---

From: "Rosen, Brian" <[email-masked]>
Date: Mon, 5 Feb 2001 09:10:40 -0500

It is, but it's still in the spec.

Remember that the spec states:
   Implementations of the H.248 protocol SHALL implement IPsec where
   the underlying operating system and the transport network supports
   IPsec.

There are few operating systems, even embedded ones, where IPSEC is not
available now.  Thus, for all practical purposes, we would expect real
IPSEC, pretty much exclusively.

The spec goes on to say:
   Implementations of the protocol using IPv4 SHALL implement
   the interim AH scheme. However, this interim scheme SHALL NOT be
   used when the underlying network layer supports IPsec. IPv6
   implementations are assumed to support IPsec and SHALL NOT use the
   interim AH scheme.

So, if you wanted to be scrupulous, you would do both, just to be safe.

Brian

> From: Matt Holdrege [mailto:[email-masked]]
> Sent: Friday, February 02, 2001 6:30 PM
> To: Rosen, Brian; [email-masked]
> Subject: Re: replay attack on interim AH?
>
>
> Brian,
>