Subject: [cgasec] To your health, and a comment on strength

From: Christian Huitema <[email-masked]>
Date: Sun, 25 Jul 2010 15:01:50 +0000

Santé! I hope you will enjoy the bar's offerings. I will not be able to join you, but I wish you luck. CGA have the potential for providing address authentication without relying on certification authority, and that's certainly valuable. Having a standard way to "prove it" is also commendable. I am sure that there will be debates on the general architecture. Instead of using IPv6 options, one could think of out of band mechanisms like ICMP, application layer challenges, or extensions to existing protocols like IKE or SSL. Also, there is no little value in authenticating the source address of a packet if the content or destination can be tampered with, so CGA can only be a piece of the puzzle. But this is not the point of my mail. I would like to discuss strength, and specifically the 2**59 issue.

The draft correctly states that the "cryptographic strength of CGA addresses makes it 2**59 times harder to forge an address than to generate a new address." But the cost of generating new addresses can be made arbitrarily harder by the "Security Parameter" and "Hash Extension" mechanism of RFC 3972. The draft does not mention it. I believe it should.

The Security Parameter is defined in RFC 3972 as three bits that define increasing difficulty of address generation, and ipso facto increasing difficulty of address spoofing. Access control lists can easily be restricted to only include addresses generated with the appropriate values of the CGA Security parameter. This will force users of a protected service to generate CGA with appropriate strength. I believe this type of restriction should be documented in the security consideration.

In the interest of full disclosure, I need to point out Microsoft's IPR statement about CGA: https://datatracker.ietf.org/ipr/676/. 

-- Christian Huitema

---

From: Sam Hartman <[email-masked]>
Date: Mon, 26 Jul 2010 11:03:04 -0400

>>>>> "Christian" == Christian Huitema <[email-masked]> writes:

    Christian> is not the point of my mail. I would like to discuss
    Christian> strength, and specifically the 2**59 issue.  The draft
    Christian> correctly states that the "cryptographic strength of CGA
    Christian> addresses makes it 2**59 times harder to forge an address
    Christian> than to generate a new address." But the cost of
    Christian> generating new addresses can be made arbitrarily harder
    Christian> by the "Security Parameter" and "Hash Extension"
    Christian> mechanism of RFC 3972. The draft does not mention it. I
    Christian> believe it should.

I completely agree this should be mentioned in the draft.For many
situations requiring the attacker to do 2**59 more work than the
generator is sufficient especially when you can scale the security
parameter.

The situation where this is insufficient is where teh product of
lifetime of addresses and resources available to an attacker exceeds
some comfortable security margin. For example, if you have an attacker
with 2**20 machines available and want your address to last for 2**40
times as long as it takes to generate an address, CGA security would
probably be inadequate.  Similarly, if you have an attacker who has
2**40 resources and you are hoping to have addresses last for 2**20
times as long as it takes to generate an address, then CGAs would be
inadequate.q I think it is important to understand this limitation, but
I also believe for many situations this is not a significant concern.

---

From: Christian Huitema <[email-masked]>
Date: Mon, 26 Jul 2010 16:08:04 +0000

> The situation where this is insufficient is where teh product of lifetime of addresses
> and resources available to an attacker exceeds some comfortable security margin.
> For example, if you have an attacker with 2**20 machines available and want your address 
> to last for 2**40 times as long as it takes to generate an address, CGA security would probably 
> be inadequate.  Similarly, if you have an attacker who has 2**40 resources and you are hoping 
> to have addresses last for 2**20 times as long as it takes to generate an address, then CGAs 
> would be inadequate. I think it is important to understand this limitation, but I also believe
> for many situations this is not a significant concern.

I believe that's a common problem for any scheme that derives identifiers from a public key. Such identifiers end up with a limited life time for a variety of reasons. The key or the hash may end up being too short, and there are downsides to making them arbitrarily long. The algorithms used in keying or hashing may be broken. The key itself may be compromised. Any system design has to account for a relatively short life of the identifiers.

-- Christian Huitema