Subject: [Hipsec] interlock for HIP

From: Andrei Gurtov <[email-masked]>
Date: Fri, 03 Feb 2006 11:27:22 +0200

Hi,

I suppose HIP in the current form without PKI is prone to 
man-in-the-middle attacks because it uses basic diffie-hellman key 
exchange. Have there been ideas of integrating the interlock protocol in 
base exchange to prevent MitM attacks? These would require one or more 
additional RTTs as the key material would be split over two or more 
messages.

Andrei

http://www.quadibloc.com/crypto/mi060709.htm
_______________________________________________
Hipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/hipsec

---

From: Pekka Nikander <[email-masked]>
Date: Fri, 3 Feb 2006 13:07:04 +0200

> I suppose HIP in the current form without PKI is prone to man-in- 
> the-middle attacks because it uses basic diffie-hellman key  
> exchange. Have there been ideas of integrating the interlock  
> protocol in base exchange to prevent MitM attacks? These would  
> require one or more additional RTTs as the key material would be  
> split over two or more messages.

Excuse my ignorance, but I can't see how it would help.  In general,  
I believe that you either need TTP, a second independent channel  
(like recognising your peer's voice), or quantum crypto, in order to  
solve the MitM problem.  To be honest, I don't even understand how  
quantum crypto would help, but I've seen claims that it would.

--Pekka

---

From: [email-masked]
Date: Fri, 3 Feb 2006 13:46:49 +0100

I agree with Pekka... However if the goal is to
establish a secure channel between two known HITs,
 Crypto Based Identifier (CBID) 
can also be useful to prevent MitM attack...

cheers,
Claude.

---

From: Andrei Gurtov <[email-masked]>
Date: Mon, 06 Feb 2006 16:34:40 +0200

I understood that IL cannot provide authentication, i.e. MitM attack of 
the form A to Z and Z to B is still possible. However, it prevents 
"stealth" MitM attack when A and B communicate but Z can eavesdrop.
Perhaps this is already prevented with current HIP mechanisms?

Andrei

---

From: Pekka Nikander <[email-masked]>
Date: Tue, 7 Feb 2006 19:59:16 +0200

> I understood that IL cannot provide authentication, i.e. MitM  
> attack of the form A to Z and Z to B is still possible. However, it  
> prevents "stealth" MitM attack when A and B communicate but Z can  
> eavesdrop.

Yes, passive attacks are already prevented by HIP.  However,  
interlock might be interesting for any "lightweight" variant of HIP.

--Pekka

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Wed, 08 Feb 2006 14:07:33 -0500

In message <[email-masked]>, Pekka Nikande
>interlock might be interesting for any "lightweight" variant of HIP.

If not used carefully, the interlock protocol provides less protection 
than you might think -- see 
http://www.cs.columbia.edu/~smb/papers/interlock.pdf

		--Steven M. Bellovin, http://www.cs.columbia.edu/~smb