Subject: [RPSEC] draft-bonica-tcp-auth-04

From: "Manav Bhatia" <[email-masked]>
Date: Wed, 22 Mar 2006 04:01:41 +0530

Hi Ron,

Is there really a need to send the "Alg ID" (identifying the MAC algorithm) 
in the TCP Enhanced Authentication Option?

The receiving TCP would associate the inbound TCP segment with a local 
key-chain based upon source IP, dest IP, source port and dest port.  It 
would then search the associated key-chain for a key whose identifier 
matches that which was specified by the incoming TCP segment option.  If the 
key returned is valid then the receiving TCP can figure out the algorithm 
from the key itself, and use that to calculate the MAC.

If so, then why do we need to send the Algorithm details in the TCP option?

Cheers,
Manav 

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: "Manav Bhatia" <[email-masked]>
Date: Wed, 22 Mar 2006 04:14:17 +0530

Ok. I got it sorted out. You do it because you don't even need to calculate 
the MAC if the Algo ID that you receive in the pkt doesn't match with the SA 
that you have.

Saves you from unnecessarily wasting CPU cycles.

Fair enough.

Cheers,
Manav
----- Original Message ----- 
From: "Manav Bhatia" <[email-masked]>
To: <>
Sent: Wednesday, March 22, 2006 4:01 AM
Subject: [RPSEC] draft-bonica-tcp-auth-04

> Hi Ron,
>
> Is there really a need to send the "Alg ID" (identifying the MAC 
> algorithm) in the TCP Enhanced Authentication Option?
>
> matches that which was specified by the incoming TCP segment option.  If 
> the key returned is valid then the receiving TCP can figure out the 
> algorithm from the key itself, and use that to calculate the MAC.
>

---

From: Gregory M Lebovitz <[email-masked]>
Date: Tue, 21 Mar 2006 15:05:22 -0800

wouldn't a successful attack then be to send a lot of packets with the 
valid Algo ID, so the peer matches the Algo ID, and continues to process 
the digest, only to find it worthless?

At 02:44 PM 3/21/2006, Manav Bhatia wrote:
>Ok. I got it sorted out. You do it because you don't even need to 
>calculate the MAC if the Algo ID that you receive in the pkt doesn't match 
>with the SA that you have.
>
>----- Original Message ----- From: "Manav Bhatia" <[email-masked]>
>To: <>

---

From: Stephen Kent <[email-masked]>
Date: Tue, 21 Mar 2006 17:59:57 -0500

>algorithm) in the TCP Enhanced Authentication Option?

the security area is very insistent on algorithm agility, so putting 
the alg ID into the option satisfies this requirement.

Steve

---

From: "Manav Bhatia" <[email-masked]>
Date: Wed, 22 Mar 2006 05:15:38 +0530

Having the Algo ID in the TCP option helps us in the cases where the algo ID 
carried in the pkt is different from the one specified in the SA. We just 
drop such pkts.

Its not much of an optimization as there only a few values defined for this 
field and an attacker can send pkts by randomly filling those 'valid' values 
in this particular field.

Manav

---

From: Stephen Kent <[email-masked]>
Date: Tue, 21 Mar 2006 19:18:04 -0500

At 5:09 AM +0530 3/22/06, Manav Bhatia wrote:
>How different would the agility be if you don't advertise the algo 
>ID and instead let the receiver look at its SA to figure out what 
>algo to use?
>
>Manav

I assume you mean the key ID that defines which key to use.

That should work too, but it creates the opportunity to have each end 
be confused about which alg to employ with a given key ID, and no 
explicit declaration (on the wire) about which alg the sender thinks 
both ends should be using.

Steve

---

From: "Vishwas Manral" <[email-masked]>
Date: Tue, 21 Mar 2006 17:42:48 -0800

Hi,

An advantage I see with using Key Id is that incase we have multiple keys
configured(in case of Key rollover), we only need to verify the packet with
the key associated with the Key Id.

Not doing this can cause unnecessary wastage of CPU cycles. It can also
amplify the attack during keyRollover when multiple keys are configured and
random packets are sent in.

By keeping the semantics of Key Id(which can be unique across all
algorithms) we get a degree of opaqueness.

Thanks,
Vishwas