Subject: [AAA-WG]: RE: Why NASREQ Key Distribution is insecure (fwd)

From: "Walker, Jesse" <[email-masked]>
Date: Tue, 5 Mar 2002 07:11:04 -0800

Thanks Bernard,

This is a very good paper that will help people understand the issues. This
has been one of the most influential papers ever published to help form the
thinking about these protocols in the cryptographic community. This is some
of the most inspired and original work by two of the very best
cryptographers in the world.

One thing to note about 3PP is, however, that almost as soon as it was
published somone pointed out a problem with it, even though the proof of
security is entirely valid! The problem arises because one of the
assumptions is wrong. The wrong assumption is that an adversary could use
the Test operation only once and then only at the "end of the game." Real
adversaries don't restrict themselves in this way. So Bellare and Rogaway
fixed this assumption and their proof and went on, although they never
published this. Victor Shoup has published one way to fix it in
http://shoup.net/papers/skey.pdf.

The point is that key distribution is a damnably hard and subtle problem in
ways that are not apparent even to the very best experts in the world. My
recommendation to 802.11 has been and is that we need to take any one of
several protocols that the crypto community has confidence in and then adapt
it to our setting, and I make the same appeal now to AAA, because fixing
this problem is outside the scope of 802.11's charter, but they cannot
succeed in fixing their security without getting key distribution correct.
Trying to roll our own is just a disaster waiting to happen.

-- Jesse

-----Original Message-----
From: Bernard Aboba [mailto:[email-masked]]
Sent: Monday, March 04, 2002 9:43 PM
To: [email-masked]
Cc: [email-masked]
Subject: Re: Why NASREQ Key Distribution is insecure (fwd)

Here is a paper by Bellare and Rogaway paper on provably 
secure 3 way key distribution which may relate to this issue.

http://www.drizzle.com/~aboba/AAA/3pkd.pdf

On Mon, 4 Mar 2002, Bernard Aboba wrote:

> This is followup documentation on the issue posted to the list
> earlier. 
> 
> ---------------------------------------------------------------------
> From: Jesse Walker <[email-masked]>:
> To:   [email-masked]
> 
> 
> >Given that the AS and AP trust each other (assumed), why
> >is a reasonable cryptographic protocol (such as CMS or even IPSec) is
> >insufficient to protect the transfer of a STA-AP session key from the AS
to
> >the AP?
> 
> There has been in fact ample discussion around exactly these points. There
> is, for instance, the whole key handoff discussion, of which AS-AP handoff
> is a special case. As a second example, there is the flap around the
> Arbaugh-Mishra 802.1X paper, which echos many of our key handoff
> discussions, and which we have also discussed.

---

From: David Spence <[email-masked]>
Date: Wed, 06 Mar 2002 11:42:55 -0500

I hesitate to bring it up, but what does all this mean for the key
distribution problems of Diameter MobileIPv4 where we now have as many as
seven entities involved (MN, old FA, old AAAF, new FA, new AAAF, HA, AAAH)
belonging to four different parties (MN, old F, new F, H)?