Subject: RE: [NSIS] Security concern during LSP establishment

From: Tschofenig Hannes <[email-masked]>
Date: Mon, 28 Jul 2003 11:52:44 +0200

hi vishal,

thanks for raising your security issue. i have some basic questions to
better understand the problem:

are all signaling messages exchanged between alice and bob protected (data
origin authentication, integrity and replay protection)?
 
if yes, how is the security association established? 

how is it possible that an adversary can benefit from the discovered label
mapping? 
what steps are necessary after discovering the label mapping to mount an
attack? 

ciao
hannes

> -----Original Message-----
> From: Vishal Zinjuvadia [mailto:[email-masked]]
> Sent: Sunday, July 27, 2003 4:36 AM
> To: [email-masked]
> Subject: [NSIS] Security concern during LSP establishment
> 
> 
> Hello All:
> 
> Following is a problem that may come up during
> exchange of label request and label mapping messages
> between two LERs using any signaling protocols.
> 
> Label Edge Routers Alice and Bob:
> 	
> 	+-------+	 	       +-------+
> 	|	|M(LR)-> 	       |       |
> 	|Alice	|----------------------|Bob    |
> 	|	|	   <-Enc(M(LM))|       |
> 	+-------+	   ^           +-------+
>                            |
>                            |
>                            |
>                          Trudy (intruder)
>                  
> Security Association is assumed to exist between Alice
> and Bob
> 
> Let M(A) be a message A.
> and Enc(M(A)) be the encrypted message A.
> 
> 1) label request sent from Alice to Bob: M(LR)
> 2) Encrypted label mapping sent from Bob to Alice:
> Enc(M(LM))
>                  
> The way most signaling protocol are designed,
> following holds true:
> 
> 1) Labels are assigned sequentially
> 2) The first label assigned after a LSR comes up is
> generally a constant value.
> 
> Based on the above assumptions, any intruder Trudy can
> get enough plain-text cipher text combinations if he
> sniffs on the link for a long enough time. Posed risks
> are:
> 
> 1) Label mapping may be discovered which could allow
> any intruder to steal resources from Bob (and probably
> many other LSRs on the LSP that Bob is a part of)
> 
> 2) Trudy can play with plain-text, cipher-text pairs
> and probably break the security association that is in
> place between Alice and Bob.
> 
> Has this problem been addressed so far? Can we use a
> non-deterministic crypto-system where if the same key
> is used to encrypt a given plain-text twice, the two
> resulting cipher-texts differ in a random fashion?
> (for e.g. the RPK algorithm proposed by Romeo,
> Romolotti, Mattaveli and Mlynek from Swiss Federal
> Institute of Technology). Such a solution seems to be
> addressing both the above risks.
> 
> Comments are much appreciated.
> 
> Thanks,
> Vishal
> 
> __________________________________
> Do you Yahoo!?
> Yahoo! SiteBuilder - Free, easy-to-use web site design software
> http://sitebuilder.yahoo.com
> 
> _______________________________________________
> nsis mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/nsis
> 

_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis

---

From: Vishal Zinjuvadia <[email-masked]>
Date: Mon, 28 Jul 2003 23:33:53 -0700 (PDT)

Hello Hannes:

Thanks for your reply.

I am hoping that the following points will help me in
making the problem clear.

The messages between Alice and Bob are expected to
have some degree of security associated with them.
Ideally they are expected to be talking over an
encrypted control channel. But at the very least,
sensitive information carried in the messages must be
encrypted. Data origin authentication & message
integrity are provided (using digitally signed hash of
the message appended to the message itself) and so is
replay protection (using sequence number or challenge
nonce).

Security association can be established
administratively (offline) or using some other
protocol. As a result, Alice and Bob share a secret
key that is known only to those two entities.

Let us assume that Trudy (intruder) is able to
determine the label-mapping (label as well as the IP
address of the node that Alice is trying to
communicate with - for e.g. Fred) using methods
described in my previous email. Then Trudy can get his
traffic switched across Bob's domain without having to
pay for it. If some sort of Service-Level Agreement
for a fixed amount of bandwidth exists between Alice
and Bob, traffic from Alice may occassionally be
denied entry into Bob's domain. Moreover, Bob may be
billing Alice based on the number of packets received
with a particular label. Trudy can launch denial of
service attacks on Bob (and also on Fred with whom the
Alice is trying to communicate via Bob's domain) since
he knows that incoming packets with valid label will
not be dropped an will be switched & routed all the
way. The impact can be much worse on Fred if the
traffic injected by Trudy is actually control traffic
for Fred.

Your comments are much appreciated.

Thanks,
Vishal 

--- Tschofenig Hannes <[email-masked]>