Subject: draft-ietf-secsh-gsskeyex-06.txt security considerations

From: "Joel N. Weber II" <[email-masked]>
Date: Mon, 14 Jul 2003 11:52:52 -0400

I'd like to propose adding the following text to
draft-ietf-secsh-gsskeyex-06.txt after the end of the paragraph in the
security considerations section that starts with ``The key exchange
method described in section 1'':

   However, the security of the key exchange does not require that the
   GSSAPI mechanism provide any replay detection.

I also notice that the key exchange mechanism is actually discussed in
section 2 and not section 1.

And it seems somewhat asymetrical that security considerations talks
about the required properties of a GSSAPI mechanism used for key
exchange, but says nothing about user authentication.

However, it also might be cleaner, if some security considerations are
sprinkled throughout the document, to move all security considerations
to the body of the document.

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 14 Jul 2003 18:41:03 -0700

> exchange, but says nothing about user authentication.

As with the lack of reference to replay [and out-of-sequence] detection,
the text you requests is likely absent because none is needed.

In the case of replay detection it is not needed since one and not more
than one non-context token GSS-API message token is to be exchanged!

In the case of GSS-API userauth, per-message integrity services are not
needed because no non-context GSS-API tokens are exchanged!

This leaves the use of mutual authentication during GSS-API userauth as
an interesting case.  Since the server is authenticated during the key
exchange phase of the protocol mutual authentication during the userauth
phase of the protocol is not needed - it neither helps security nor
hurts it in this particular case.

Perhaps the fact that and reasons why GSS-API replay and out-of-sequence
detection are not needed at all here and why GSS-API mutual
authentication and per-message integrity services are not needed in the
userauth case ought to be stated.

Cheers,

Nico
--

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Wed, 16 Jul 2003 10:02:19 +0200 (CEST)

> > exchange, but says nothing about user authentication.

I believe the document specifies the minimum properties required for
GSS-API contexts in both keyex and userauth.  As Nico points out, there
are fewer requirements in the userauth case, because there are no
non-context tokens exchanged.

> userauth case ought to be stated.

The document has just gone into last call.  I anticipate that there will
be one more cycle to address comments raised during last call and improve
the security considerations section; if so, I'll try to address this issue
more clearly.  But IMNSHO it's not worth a cycle for this alone.

-- Jeff

---

From: Nicolas Williams <[email-masked]>
Date: Wed, 16 Jul 2003 06:38:28 -0700

> more clearly.  But IMNSHO it's not worth a cycle for this alone.

Agreed.  Not having such text is not a failure to describe a real
security issue (or interop, for that matter).

Cheers,

Nico
--