Received: from ndmsnpf03.ndc.nasa.gov (ndmsnpf03.ndc.nasa.gov [198.117.0.123]) by maillists.intel-research.net (8.13.8/8.13.8) with ESMTP id nB8HXZbB011829 for ; Tue, 8 Dec 2009 09:33:35 -0800 Received: from ndjsppt02.ndc.nasa.gov (ndjsppt02.ndc.nasa.gov [198.117.1.101]) by ndmsnpf03.ndc.nasa.gov (Postfix) with ESMTP id BB6DA2D835E for ; Tue, 8 Dec 2009 11:33:35 -0600 (CST) Received: from ndjshub03.ndc.nasa.gov (ndjshub03.ndc.nasa.gov [198.117.4.162]) by ndjsppt02.ndc.nasa.gov (8.14.3/8.14.3) with ESMTP id nB8HXZhi019400 for ; Tue, 8 Dec 2009 11:33:35 -0600 Received: from NDJSSCC03.ndc.nasa.gov ([198.117.4.170]) by ndjshub03.ndc.nasa.gov ([198.117.4.162]) with mapi; Tue, 8 Dec 2009 11:33:35 -0600 From: "Ivancic, William D. (GRC-RHN0)" To: "dtn-security@maillists.intel-research.net" Date: Tue, 8 Dec 2009 11:33:06 -0600 Thread-Topic: RE: Bundle Authentication Block interoperability Thread-Index: Acp4LIB0HjGqJtUHRjKGFc/JyBTVyg== Message-ID: <3A5AA67A8B120B48825BFFCF54438561945FE473EC@NDJSSCC03.ndc.nasa.gov> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=1.12.8161:2.4.5, 1.2.40, 4.0.166 definitions=2009-12-08_08:2009-11-30, 2009-12-08, 2009-12-08 signatures=0 Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by maillists.intel-research.net id nB8HXZbB011829 Subject: Re: [dtn-security] Bundle Authentication Block interoperability X-BeenThere: dtn-security@maillists.intel-research.net X-Mailman-Version: 2.1.9 Precedence: list List-Id: DTN Security Discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Dec 2009 17:33:35 -0000 (Forwarded on Scotts behalf) Not quite, Will. The ION key file does need to contain a 20-byte key, which is also what is specified in the DTN2 configuration command as 40 ASCII characters. The ION key file does *not* need to contain an ASCII key. In fact, there's a convenience utility provided in ION for making up highly random hexadecimal 160-bit SHA1 keys and writing them to files, in case you don't want to do it yourself. Scott > -----Original Message----- > From: dtn-security-bounces@maillists.intel-research.net [mailto:dtn- > security-bounces@maillists.intel-research.net] On Behalf Of Ivancic, > William D. (GRC-RHN0) > Sent: Tuesday, December 08, 2009 8:43 AM > To: Ivancic, William D. (GRC-RHN0); dtn-security@maillists.intel- > research.net > Subject: Re: [dtn-security] Bundle Authentication Block > interoperability > > We discovered our problem. > > DTN2 uses a 40 character hex string. ION key file should contain a 20 > byte ASCII key, not the hex equivalent of that as DTN2 expects. Thus, > one can hexdump the 20 byte ION key file and use the hex value of that > key in the > DTN2 config. > > Still interested to know if anyone has run BAB interoperability with > various DTN builds. > > > --Will ****************************** William D. Ivancic Phone 216-433-3494 Fax 216-433-8705 Networking Lab 216-433-2620 DTN Lab 216-433-2981 Mobile 440-503-4892 http://roland.grc.nasa.gov/~ivancic Received: from TX2EHSOBE006.bigfish.com (tx2ehsobe003.messaging.microsoft.com [65.55.88.13]) by maillists.intel-research.net (8.13.8/8.13.8) with ESMTP id nB8GnXkN009640 for ; Tue, 8 Dec 2009 08:49:33 -0800 Received: from mail40-tx2-R.bigfish.com (10.9.14.247) by TX2EHSOBE006.bigfish.com (10.9.40.26) with Microsoft SMTP Server id 8.1.340.0; Tue, 8 Dec 2009 16:49:34 +0000 Received: from mail40-tx2 (localhost.localdomain [127.0.0.1]) by mail40-tx2-R.bigfish.com (Postfix) with ESMTP id 7810AE28485; Tue, 8 Dec 2009 16:49:33 +0000 (UTC) X-SpamScore: -30 X-BigFish: VPS-30(zz542N1432R98dN9371Pzz1202hzzz2dh6bh87h61h) X-Spam-TCS-SCL: 0:0 X-FB-DOMAIN-IP-MATCH: fail Received: from mail40-tx2 (localhost.localdomain [127.0.0.1]) by mail40-tx2 (MessageSwitch) id 1260290971738389_9019; Tue, 8 Dec 2009 16:49:31 +0000 (UTC) Received: from TX2EHSMHS009.bigfish.com (unknown [10.9.14.250]) by mail40-tx2.bigfish.com (Postfix) with ESMTP id 14EA55C0175; Tue, 8 Dec 2009 16:49:30 +0000 (UTC) Received: from imx2.tcd.ie (134.226.1.156) by TX2EHSMHS009.bigfish.com (10.9.99.109) with Microsoft SMTP Server id 14.0.482.32; Tue, 8 Dec 2009 16:49:27 +0000 Received: from Vams.imx2 (imx2.tcd.ie [134.226.1.156]) by imx2.tcd.ie (Postfix) with SMTP id 2871F68008; Tue, 8 Dec 2009 16:49:27 +0000 (GMT) Received: from imx2.tcd.ie ([134.226.1.156]) by imx2.tcd.ie ([134.226.1.156]) with SMTP (gateway) id A064F524B4B; Tue, 08 Dec 2009 16:49:27 +0000 Received: from [134.226.36.180] (sfarrell.dsg.cs.tcd.ie [134.226.36.180]) by imx2.tcd.ie (Postfix) with ESMTP id 1449E68009; Tue, 8 Dec 2009 16:49:27 +0000 (GMT) Message-ID: <4B1E83A0.6070205@cs.tcd.ie> Date: Tue, 8 Dec 2009 16:49:36 +0000 From: Stephen Farrell User-Agent: Thunderbird 2.0.0.23 (X11/20090812) MIME-Version: 1.0 To: "Ivancic, William D. (GRC-RHN0)" References: <3A5AA67A8B120B48825BFFCF54438561945FE46FA3@NDJSSCC03.ndc.nasa.gov> <3A5AA67A8B120B48825BFFCF54438561945FE47367@NDJSSCC03.ndc.nasa.gov> In-Reply-To: <3A5AA67A8B120B48825BFFCF54438561945FE47367@NDJSSCC03.ndc.nasa.gov> X-Enigmail-Version: 0.96.0 Content-Type: text/plain; charset="ISO-8859-1" Content-Transfer-Encoding: 7bit X-AntiVirus-Status: MessageID = A164F524B4B X-AntiVirus-Status: Host: imx2.tcd.ie X-AntiVirus-Status: Action Taken: X-AntiVirus-Status: NONE X-AntiVirus-Status: Checked by TCD Vexira. (version=1.60.2 VDF=10.115.3) X-Reverse-DNS: imx2.tcd.ie Cc: "dtn-security@maillists.intel-research.net" Subject: Re: [dtn-security] Bundle Authentication Block interoperability X-BeenThere: dtn-security@maillists.intel-research.net X-Mailman-Version: 2.1.9 Precedence: list List-Id: DTN Security Discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Dec 2009 16:49:33 -0000 Ivancic, William D. (GRC-RHN0) wrote: > We discovered our problem. > > DTN2 uses a 40 character hex string. ION key file should contain a 20 byte ASCII key, not the hex equivalent of that as DTN2 expects. Thus, one can hexdump the 20 byte ION key file and use the hex value of that key in the DTN2 config. > > Still interested to know if anyone has run BAB interoperability with various DTN builds. Not that I know of. I've an MSc student planning to do something on this next spring/summer, so would be interested in knowing of interop holes that are worth filling in then. Good to get the basic ION/DTN2 BAB stuff done though. Well done. S. > > > --Will > > >> -----Original Message----- >> From: dtn-security-bounces@maillists.intel-research.net [mailto:dtn- >> security-bounces@maillists.intel-research.net] On Behalf Of Ivancic, >> William D. (GRC-RHN0) >> Sent: Monday, December 07, 2009 2:24 PM >> To: dtn-security@maillists.intel-research.net >> Subject: [dtn-security] Bundle Authentication Block interoperability >> >> We have been running DTN-2 and ION interoperability tests for BAB up to >> 64 Kbyte blocks using "dtn" naming. >> >> We have run into a problem in that it appears to be in the Hash >> algorithm or implementation. >> >> DTN2 code is using the OpenSSL HMAC functions. >> >> According to Scott Burleigh, "The ION code's SHA1 implementation is >> taken from git, which seems to be using the SHA 180-1 Reference >> Implementation (Compact Version) developed by Paul Kocher. The HMAC >> implementation was written by Bill Van Biesen from RFC 2104 and >> validated with NIST test vectors." >> >> I was wondering if any other DTN bundling implementations have >> implemented BAB and tested it with other DTN bundling implementations? >> (i.e. Spindle III, Symbian, JAVA implementations, etc...). >> >> >> Will > > _______________________________________________ > dtn-security mailing list > dtn-security@maillists.intel-research.net > http://maillists.intel-research.net/mailman/listinfo/dtn-security > Received: from ndmsnpf02.ndc.nasa.gov (ndmsnpf02.ndc.nasa.gov [198.117.0.122]) by maillists.intel-research.net (8.13.8/8.13.8) with ESMTP id nB8Gh4bY009203 for ; Tue, 8 Dec 2009 08:43:04 -0800 Received: from ndjsppt03.ndc.nasa.gov (ndjsppt03.ndc.nasa.gov [198.117.1.102]) by ndmsnpf02.ndc.nasa.gov (Postfix) with ESMTP id 8DF3310804F for ; Tue, 8 Dec 2009 10:43:04 -0600 (CST) Received: from ndjshub05.ndc.nasa.gov (ndjshub05.ndc.nasa.gov [198.117.4.164]) by ndjsppt03.ndc.nasa.gov (8.14.3/8.14.3) with ESMTP id nB8Gh4An009175 for ; Tue, 8 Dec 2009 10:43:04 -0600 Received: from NDJSSCC03.ndc.nasa.gov ([198.117.4.170]) by ndjshub05.ndc.nasa.gov ([198.117.4.164]) with mapi; Tue, 8 Dec 2009 10:43:04 -0600 From: "Ivancic, William D. (GRC-RHN0)" To: "Ivancic, William D. (GRC-RHN0)" , "dtn-security@maillists.intel-research.net" Date: Tue, 8 Dec 2009 10:42:33 -0600 Thread-Topic: Bundle Authentication Block interoperability Thread-Index: Acp3cta+p5YCBVDVQtitzO8crwDp2AAsi4Mw Message-ID: <3A5AA67A8B120B48825BFFCF54438561945FE47367@NDJSSCC03.ndc.nasa.gov> References: <3A5AA67A8B120B48825BFFCF54438561945FE46FA3@NDJSSCC03.ndc.nasa.gov> In-Reply-To: <3A5AA67A8B120B48825BFFCF54438561945FE46FA3@NDJSSCC03.ndc.nasa.gov> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=1.12.8161:2.4.5, 1.2.40, 4.0.166 definitions=2009-12-08_08:2009-11-30, 2009-12-08, 2009-12-08 signatures=0 Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by maillists.intel-research.net id nB8Gh4bY009203 Subject: Re: [dtn-security] Bundle Authentication Block interoperability X-BeenThere: dtn-security@maillists.intel-research.net X-Mailman-Version: 2.1.9 Precedence: list List-Id: DTN Security Discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Dec 2009 16:43:04 -0000 We discovered our problem. DTN2 uses a 40 character hex string. ION key file should contain a 20 byte ASCII key, not the hex equivalent of that as DTN2 expects. Thus, one can hexdump the 20 byte ION key file and use the hex value of that key in the DTN2 config. Still interested to know if anyone has run BAB interoperability with various DTN builds. --Will >-----Original Message----- >From: dtn-security-bounces@maillists.intel-research.net [mailto:dtn- >security-bounces@maillists.intel-research.net] On Behalf Of Ivancic, >William D. (GRC-RHN0) >Sent: Monday, December 07, 2009 2:24 PM >To: dtn-security@maillists.intel-research.net >Subject: [dtn-security] Bundle Authentication Block interoperability > >We have been running DTN-2 and ION interoperability tests for BAB up to >64 Kbyte blocks using "dtn" naming. > >We have run into a problem in that it appears to be in the Hash >algorithm or implementation. > >DTN2 code is using the OpenSSL HMAC functions. > >According to Scott Burleigh, "The ION code's SHA1 implementation is >taken from git, which seems to be using the SHA 180-1 Reference >Implementation (Compact Version) developed by Paul Kocher. The HMAC >implementation was written by Bill Van Biesen from RFC 2104 and >validated with NIST test vectors." > >I was wondering if any other DTN bundling implementations have >implemented BAB and tested it with other DTN bundling implementations? >(i.e. Spindle III, Symbian, JAVA implementations, etc...). > > >Will Received: from ndjsnpf03.ndc.nasa.gov (ndjsnpf03.ndc.nasa.gov [198.117.1.123]) by maillists.intel-research.net (8.13.8/8.13.8) with ESMTP id nB7JTxQw012465 for ; Mon, 7 Dec 2009 11:30:00 -0800 Received: from ndjsppt02.ndc.nasa.gov (ndjsppt02.ndc.nasa.gov [198.117.1.101]) by ndjsnpf03.ndc.nasa.gov (Postfix) with ESMTP id 4AB6231082E for ; Mon, 7 Dec 2009 13:30:29 -0600 (CST) Received: from ndjshub02.ndc.nasa.gov (ndjshub02-pub.ndc.nasa.gov [198.117.1.161]) by ndjsppt02.ndc.nasa.gov (8.14.3/8.14.3) with ESMTP id nB7JU11N004188 for ; Mon, 7 Dec 2009 13:30:29 -0600 Received: from NDJSSCC03.ndc.nasa.gov ([198.117.4.170]) by ndjshub02.ndc.nasa.gov ([198.117.1.161]) with mapi; Mon, 7 Dec 2009 13:24:31 -0600 From: "Ivancic, William D. (GRC-RHN0)" To: "dtn-security@maillists.intel-research.net" Date: Mon, 7 Dec 2009 13:24:04 -0600 Thread-Topic: Bundle Authentication Block interoperability Thread-Index: Acp3cta+p5YCBVDVQtitzO8crwDp2A== Message-ID: <3A5AA67A8B120B48825BFFCF54438561945FE46FA3@NDJSSCC03.ndc.nasa.gov> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=1.12.8161:2.4.5, 1.2.40, 4.0.166 definitions=2009-12-07_10:2009-11-30, 2009-12-07, 2009-12-07 signatures=0 Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by maillists.intel-research.net id nB7JTxQw012465 Subject: [dtn-security] Bundle Authentication Block interoperability X-BeenThere: dtn-security@maillists.intel-research.net X-Mailman-Version: 2.1.9 Precedence: list List-Id: DTN Security Discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 Dec 2009 19:30:00 -0000 We have been running DTN-2 and ION interoperability tests for BAB up to 64 Kbyte blocks using "dtn" naming. We have run into a problem in that it appears to be in the Hash algorithm or implementation. DTN2 code is using the OpenSSL HMAC functions. According to Scott Burleigh, "The ION code's SHA1 implementation is taken from git, which seems to be using the SHA 180-1 Reference Implementation (Compact Version) developed by Paul Kocher. The HMAC implementation was written by Bill Van Biesen from RFC 2104 and validated with NIST test vectors." I was wondering if any other DTN bundling implementations have implemented BAB and tested it with other DTN bundling implementations? (i.e. Spindle III, Symbian, JAVA implementations, etc...). Will ****************************** William D. Ivancic Phone 216-433-3494 Fax 216-433-8705 Networking Lab 216-433-2620 DTN Lab 216-433-2981 Mobile 440-503-4892 http://roland.grc.nasa.gov/~ivancic