Subject: [VIPR] VIPR Privacy

From: Marc Petit-Huguenin <[email-masked]>
Date: Thu, 19 Jan 2012 07:37:29 -0800

Restarting the discussion on the subject of VIPR privacy, based on Michael
Procter document draft-procter-vipr-privacy-concerns.

1.1. Caller-ID leaks

The VIPR drafts have been modified to hash the Caller-ID when method A is
used.  A new method "C" will also be published in the coming weeks, methods
that invert the Caller-ID and the start/stop time.

1.2. Source IP identification

One of the solution to hide the source of a PVP request is to use an
intermediate TURN server, TURN server which is already available is the RELOAD
overlay has to support -ICE transports.  Depending on the decision about ICE,
we may have to design another mechanism to hide the PVP client IP address.

1.3. Traffic statistics leakage

One of the proposed solution is to make random PVP calls to increase the
noise.  Unfortunately the this would increase the load on the PVP servers
without really preventing a motivated party to collect statistical information.

2.1 Obtaining the PVP credentials in an office environment

This attack uses the facts that PVP credentials are shared inside an
organization (enterprise) and that people assume that nothing bad can happen
inside this organization.  This is the same fallacy that make people think
that they are protected by their firewall.

One proposed solution is to not share the credentials between users inside an
organization by assigning a different VServiceID to each user.  This also
makes the case for ICE support, as assigning a VServiceID to each user is
equivalent to running a VIPR server in each device.

2.2 Registering multiple PVP servers to validate based on time tolerance

The idea is to register enough PVP servers to increase the probability of
guessing the right start/stop time for a call.  If the maximum duration of the
calls is D and the rounding is R then registering (D/R * (D/R - 1) / 2) PVP
servers permits to validate 100% of the calls made inside this duration.

Not sharing PVP credentials inside an organization also makes this attack less
interesting.

- -- 
Marc Petit-Huguenin
Personal email: [email-masked]
Professional email: [email-masked]
Blog: http://blog.marc.petit-huguenin.org