Subject: [karp] Modularity of Key Management

From: RJ Atkinson <[email-masked]>
Date: Tue, 31 Aug 2010 16:00:08 -0400

If one looks at the history of key management, one trend
becomes clear pretty quickly.  Humans almost always design
key management algorithms/protocols that contain serious 
flaws.

There are a wide range of examples in the world, including
some within the IETF.  However, I'll use an example that
is sometimes used in college courses.

Back in 1978, the Needham & Schroeder protocol for centralised
key distribution was first published.[NS78]  Subsequently,
Denning & Sacco published an attack on that protocol, and
proposed a fix based on timestamps.[DS81]  Needham & Schroeder
expressed concerns about that proposed fix and made a different
proposed fix.[NS87] Gong subsequently criticised the proposed 
fix from Denning & Sacco and suggested it also had issues.
[Gong92]  Kerberos was built upon the Needham & Schroder
technology, and by 1989 was in its 5th version.[KNS89]
In January 1997, Lowe published a paper presenting attacks
on multiple protocols, including the Needham Schroeder protocol.
[Lowe97]

The conclusion that I reach from this (and other similar
histories) is that any mechanism this WG decides to persue
needs to be modular -- so that the mechanism can be either
replaced wholesale or corrected incrementally over time,
as flaws are discovered in whichever cryptologic approach
this WG might adopt.

Yours,

Ran

REFERENCES:

[NS78] R.M. Needham & M.D. Schroeder,
	"Using encryption for authentication in large networks 
	of computers", Commun. ACM Vol 21, Issue 12, December 1978, 
	pp. 993-999.

[NS87] R.M. Needham & M.D. Schroeder, "Authentication
	Revisisted", ACM Operating Systems Review, Vol. 21,
	Number 7, January 1987.

[DS81] D.E. Denning & G.M. Sacco, 
	"Timestamps in key distribution protocols", 
	Communications of the ACM, Vol 24, Number 8, 
	August 1981, p.533-536. 

[KNS89] J. Kohl, B.C. Neuman, & J. Steiner, "The Kerberos
	Netework Authentication Service", Version 5,
	Draft 2, MIT Product Athena, 6 November 1989.
	
[BM90] S.M. Bellovin & M. Merritt, "Limitations of the
	Kerberos Authentication System", ACM Computer
	Communication Review, October 1980.

[Gong92] L. Gong, "A Security Risk of Depending on 
	Synchronised Clocks", ACM Operating Systems Review,
	Volume 26, Number 1, January 1992, pp. 49-53

[Lowe97] Gavin Lowe, "A Family of Attacks upon Authentication
	Protocols", Dept of Maths & CS, University of Leicester,
	Leicester, England, UK, January 1997.