Subject: [NSIS] Security concern during LSP establishment

From: Vishal Zinjuvadia <[email-masked]>
Date: Sat, 26 Jul 2003 19:35:43 -0700 (PDT)

Hello All:

Following is a problem that may come up during
exchange of label request and label mapping messages
between two LERs using any signaling protocols.

Label Edge Routers Alice and Bob:
	
	+-------+	 	       +-------+
	|	|M(LR)-> 	       |       |
	|Alice	|----------------------|Bob    |
	|	|	   <-Enc(M(LM))|       |
	+-------+	   ^           +-------+
                           |
                           |
                           |
                         Trudy (intruder)
                 
Security Association is assumed to exist between Alice
and Bob

Let M(A) be a message A.
and Enc(M(A)) be the encrypted message A.

1) label request sent from Alice to Bob: M(LR)
2) Encrypted label mapping sent from Bob to Alice:
Enc(M(LM))
                 
The way most signaling protocol are designed,
following holds true:

1) Labels are assigned sequentially
2) The first label assigned after a LSR comes up is
generally a constant value.

Based on the above assumptions, any intruder Trudy can
get enough plain-text cipher text combinations if he
sniffs on the link for a long enough time. Posed risks
are:

1) Label mapping may be discovered which could allow
any intruder to steal resources from Bob (and probably
many other LSRs on the LSP that Bob is a part of)

2) Trudy can play with plain-text, cipher-text pairs
and probably break the security association that is in
place between Alice and Bob.

Has this problem been addressed so far? Can we use a
non-deterministic crypto-system where if the same key
is used to encrypt a given plain-text twice, the two
resulting cipher-texts differ in a random fashion?
(for e.g. the RPK algorithm proposed by Romeo,
Romolotti, Mattaveli and Mlynek from Swiss Federal
Institute of Technology). Such a solution seems to be
addressing both the above risks.

Comments are much appreciated.

Thanks,
Vishal

__________________________________
Do you Yahoo!?
Yahoo! SiteBuilder - Free, easy-to-use web site design software
http://sitebuilder.yahoo.com

_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis

---

From: Tschofenig Hannes <[email-masked]>
Date: Tue, 29 Jul 2003 17:54:43 +0200

hi vishal, 

from your description it sounds that the problem is that the adversary is
able to injecting data traffic. the data traffic - i assume mpls traffic -
is marked with a specific label to force some other entity to believe that
the traffic belongs to someone else.

is this observation correct?

is the adversary able to observe the label mapping also from the data
traffic itself or only from the signaling messages? 

what assumptions must be met in order for an adversary to inject data
traffic? is only an in-path adversary able to perform this attack? is it
necessary for the adversary to be located inside the mpls domain?

i assume that it is not possible to inject bogus signaling messages since
they experience proper security protection. 

ciao
hannes

> -----Original Message-----
> From: Vishal Zinjuvadia [mailto:[email-masked]]
> Sent: Tuesday, July 29, 2003 8:33 AM
> To: Tschofenig Hannes
> Subject: RE: [NSIS] Security concern during LSP establishment
> 
> 
> Hello Hannes:
> 
> Thanks for your reply.
> 
> I am hoping that the following points will help me in
> making the problem clear.
> 
> The messages between Alice and Bob are expected to
> have some degree of security associated with them.
> Ideally they are expected to be talking over an
> encrypted control channel. But at the very least,
> sensitive information carried in the messages must be
> encrypted. Data origin authentication & message
> integrity are provided (using digitally signed hash of
> the message appended to the message itself) and so is
> replay protection (using sequence number or challenge
> nonce).
> 
> Security association can be established
> administratively (offline) or using some other
> protocol. As a result, Alice and Bob share a secret
> key that is known only to those two entities.
> 
> Let us assume that Trudy (intruder) is able to
> determine the label-mapping (label as well as the IP
> address of the node that Alice is trying to
> communicate with - for e.g. Fred) using methods
> described in my previous email. Then Trudy can get his
> traffic switched across Bob's domain without having to
> pay for it. If some sort of Service-Level Agreement
> for a fixed amount of bandwidth exists between Alice
> and Bob, traffic from Alice may occassionally be
> denied entry into Bob's domain. Moreover, Bob may be
> billing Alice based on the number of packets received
> with a particular label. Trudy can launch denial of
> service attacks on Bob (and also on Fred with whom the
> Alice is trying to communicate via Bob's domain) since
> he knows that incoming packets with valid label will
> not be dropped an will be switched & routed all the
> way. The impact can be much worse on Fred if the
> traffic injected by Trudy is actually control traffic
> for Fred.
> 
> Your comments are much appreciated.
> 
> Thanks,
> Vishal 
> 
> --- Tschofenig Hannes <[email-masked]>
> wrote:
> > hi vishal,
> > 
> > thanks for raising your security issue. i have some
> > basic questions to
> > better understand the problem:
> > 
> > are all signaling messages exchanged between alice
> > and bob protected (data
> > origin authentication, integrity and replay
> > protection)?
> >  
> > if yes, how is the security association established?
> > 
> > 
> > how is it possible that an adversary can benefit
> > from the discovered label
> > mapping? 
> > what steps are necessary after discovering the label
> > mapping to mount an
> > attack? 
> > 
> > ciao
> > hannes
> > 
> > > -----Original Message-----
> > > From: Vishal Zinjuvadia
> > [mailto:[email-masked]]
> > > Sent: Sunday, July 27, 2003 4:36 AM
> > > To: [email-masked]
> > > Subject: [NSIS] Security concern during LSP
> > establishment
> > > 
> > > 
> > > Hello All:
> > >