Subject: krb-wg-crypto-03 security considerations

From: Tom Yu <[email-masked]>
Date: Fri, 04 Apr 2003 18:21:59 -0500

We should probably add text to the security considerations,
emphasizing the importance of some factors involved in the krb4
protocol vulnerabilities.  Suggested text follows:

    In [Bellovin91], there is a suggestion that analyses of encryption
    schemes should include a model of an attacker capable of
    submitting known plaintexts to be encrypted with an unknown key,
    as well as being able to perform many types of operations on known
    protocol messages.  Recent experiences with the chosen-plaintext
    attacks on Kerberos version 4 bear out the value of this
    suggestion.

    The use of unkeyed encrypted checksums, such as those used in the
    single-DES cryptosystems specified in [Kerb1510], allows for
    cut-and-paste attacks, especially if a confounder is not used.  In
    addition, unkeyed encrypted checksums are vulnerable to
    chosen-plaintext attacks: an attacker with access to an encryption
    oracle can easily encrypt the required unkeyed checksum along with
    the chosen plaintext.  [Bellovin99]  These weaknesses, combined
    with a common implementation design choice described below, allow
    for a cross-protocol attack from version 4 to version 5.

    The use of a random confounder is an important means of preventing
    an attacker from making effective use of protocol exchanges as an
    encryption oracle.  In Kerberos version 4, the encryption of
    constant plaintext to constant ciphertext makes an effective
    encryption oracle for an attacker.  The use of random confounders
    in [Kerb1510] frustrates this sort of chosen-plaintext attack.

    Using the same key for multiple purposes can enable or increase
    the scope of chosen-plaintext attacks.  Some software which
    implements both versions 4 and 5 of the Kerberos protocol uses the
    same keys for both versions of the protocol.  This enables the
    encryption oracle of version 4 to be used to attack version 5.
    Vulnerabilities such as this cross-protocol attack reinforce the
    wisdom of not using a key for multiple purposes.

    [Bellovin91] Bellovin, S. M., and Merritt, M., "Limitations of the
    Kerberos Authentication System", in Proceedings of the Winter 1991
    Usenix Security Conference, January 1991.

    [Bellovin99] Bellovin, S. M., and Atkins, D., private
    communications, 1999.