Subject: Comments on GSSEasy 01

From: Dennis Glatting <[email-masked]>
Date: Tue, 9 Nov 1999 20:16:28 -0800 (PST)

I was at the CAT session but missed the presentation on GSS Easy, so I
apologize if this has been covered already.

In Section 1 the document states "the number of iterations of the OWF
should take about 1/4 of a second on the client" I have a problems
with this logic. First, that 1/4 of a second is against a given
client, say Client-A with an N of 10,000. Client-B may be
significantly faster with 1/4 OF A second represented by an N of
50,000, perhaps even 100,000. If an N of 8,000, even 20,000 represents
1/4 of a second on the server then the server's load is significantly
greater than the clients. I believe the focus on the client is wrong
since the server is often the more important resource. I don't believe
we can make the assumption a server is always going to be faster than
its clients.

Second, if a given Client has an N of 10,000 on a PII 266, Johnny
Cracker could be sporting a nice new PIII 700, maybe by the summer of
2000 a 1 GHz system. The amount of resource consumption is greater for
the client and server than Johnny. In many cases, I argue, Johnny is
able to upgrade his system at a faster rate and with less expenditure
justification than a corporate client or server. I believe an N
greater than one is of dubious value.

Last, if an N of 10,000 takes a server 1/4 second to process, I
imagine I could carry out an effective DoS attack against the server
by sending a bunch of packets with different cofounders, say 120 in
the space of a few milliseconds. This would place a 30 second load on
the server.

In Section 4 I believe we can improve the security slightly by using
directional keys. We could have an IDKi, IDKa, CDKi, and CDKa. There
is enough information to do so even without mutual authentication. For
example, IDKi and IDKa could be constructed as: 

	IDKi = OWF ( PassKey, server-name, client-name, 
			Time-C, Confounder-C, PassKey ) 
	IDKa = OWF ( PassKey, client-name, server-name, 
			Time-C, Confounder-C, PassKey )

Notice the position of the client and server name is different.

Finally, in the context establishment token I recommend contextFlags
be included in the hash. I am concerned about the effect on the system
if those bits where either intentionally changed by a MIM or by
network error.

--
Dennis Glatting
Copyright (c) 1999 Software Munitions

==========================================================================
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]