Subject: anonymous DH and MITM attacks

From: [email-masked] (Sam Hartman)
Date: Mon, 2 Dec 2002 14:58:38 -0500 (EST)

One thing I noticed is that if anonymous DH is combined with some
other preauth type--even something weak like encrypted timestamp, and
the DH key is combined with the reply key, you cannot successfully
decrypt the AS reply if you are attacked by a man-in-the-middle.

This means that if you successfully decrypt the AS reply you know that
you were not tricked into exposing your password to a dictionary
attack.

I think this decreases the value of a MITM attack somewhat.  While you
can certainly attack any given principal by acting as a MITM for one
of their requests and starting an offline dictionary attack, you
probably would get noticed fairly quickly if you attacked all
requests.

--Sam

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 2 Dec 2002 12:28:57 -0800

Sounds good, but, does this fall afoul of the EKE patents?

Nico

---

From: Lawrence Greenfield <[email-masked]>
Date: Mon, 2 Dec 2002 15:32:28 -0500

Date: Mon,  2 Dec 2002 14:58:38 -0500 (EST)
   From: [email-masked] (Sam Hartman)

The obvious thing is for the attacker to just drop the UDP reply,
forcing the client to retry.

But I agree that anonymous DH is certainly a step in the right
direction.

I would rather see TLS with RSA keys, however. It strictly dominates
an anonymous DH method, since at worst it is vulnerable to the same
problems. At best, a site can distribute public key certificates. In
the happy middle, client software could cache the KDC's certificate,
giving ssh-like security.

Using TLS w/ RSA keys guarantees at least the DH level of security,
and allows sites and vendors to customize their security policy.

Larry

PS I had a flame prepared in regards to MIT's situation with TLS, but
have decided to suppress it for now.

---

From: Sam Hartman <[email-masked]>
Date: Mon, 02 Dec 2002 15:42:35 -0500

>>>>> "Lawrence" == Lawrence Greenfield <[email-masked]> writes:

    Lawrence>    Date: Mon, 2 Dec 2002 14:58:38 -0500 (EST) From:
    Lawrence> [email-masked] (Sam Hartman)

    Lawrence>    One thing I noticed is that if anonymous DH is
    Lawrence> combined with some other preauth type--even something
    Lawrence> weak like encrypted timestamp, and the DH key is
    Lawrence> combined with the reply key, you cannot successfully
    Lawrence> decrypt the AS reply if you are attacked by a
    Lawrence> man-in-the-middle.

    Lawrence> The obvious thing is for the attacker to just drop the
    Lawrence> UDP reply, forcing the client to retry.
I suspect this won't work actually.  Or at least the client will know
that something unusual is going on.

Note that in DH with encrypted timestamp, you need two round trips.
You probably include a cookie in the second round trip indicating the
result of the DH exchange for the KDC.  If you consider it an error
for a cookie to be issued and end up not working, it is somewhat
difficult for an attacker to avoid getting noticed.

I've already explained my concerns with TLS; I suspect Doug will end
up having to judge consensus on that issue.

---

From: "Douglas E. Engert" <[email-masked]>
Date: Mon, 02 Dec 2002 14:55:47 -0600

So far we have had quite a spirited discussion based on Frank's
article on cracking W2000/XP passwords. 

There are proposals for using DH, DCE RFC62.0 and other methods
to solve this problem. 

We have heard from MIT, Sun, Cisco and others. But we have not 
heard anything from Microsoft.   

I would like to hear from Microsoft (either off-line, or to the list),
so we could have some idea of the urgency they are placing on this 
problem, and to comment on the proposals, as to which they might 
consider to implement. What ever is done, I would like to see 
interoperability.

-- 

 Douglas E. Engert  <[email-masked]>
 Argonne National Laboratory
 9700 South Cass Avenue
 Argonne, Illinois  60439 
 (630) 252-5444

---

From: Sam Hartman <[email-masked]>
Date: Mon, 02 Dec 2002 16:11:03 -0500

>>>>> "Nicolas" == Nicolas Williams <[email-masked]> writes:

    Nicolas> Sounds good, but, does this fall afoul of the EKE
    Nicolas> patents?  Nico

I don't think it has issues with the EKE patents and friends.

It does still have a MITM problem.

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 2 Dec 2002 13:13:47 -0800

> It does still have a MITM problem.

Yes, but you've described how a MITM attqack can be discovered.  This
could be sufficient.

Nico
--

---

From: Lawrence Greenfield <[email-masked]>
Date: Mon, 2 Dec 2002 15:32:28 -0500

Larry