Subject: Re: [tsvwg] RFC 6083: Query regarding NULL AUTH Key in DTLS over SCTP

From: Michael Tuexen <[email-masked]>
Date: Tue, 2 Jun 2020 20:50:52 +0200

> On 30. May 2020, at 11:57, Sidhartha pant <[email-masked]> wrote:
> 
> Hi Michael,
Hi Sidhartha,
>  
> I have query regarding RFC 6083 section 4.8, as per this section:-
>  
> “The endpoint-pair shared secret for Shared Key Identifier 0 is empty
>    and MUST be used when establishing a DTLS connection”
Correct. You don't know anything as the beginning. This is similar to TlS/TCP.
>  
> Also according to the RFC 4895 section 9. An endpoint is safe from an attack from the “Man in the Middle” (MTM) if the endpoint pair shared Key is used.
>  
> “If an endpoint pair shared key is used, even a true man in the middle
>    cannot inject chunks, which are required to be authenticated, even if
>    he intercepts the initial message exchange.  The endpoint also knows
>    that it is accepting authenticated chunks from a peer who knows the
>    endpoint pair shared key.”
It might be clearer to read this paragraph in the context of the paragraph
before it.

If you don't use an endpoint pair shared key, you only use the RANDOM parameter
values exchanged in the INIT and INIT-ACK chunk. So, in this case, if you capture
as a MiTM the association setup, you can spoof authenticated packets. If you
don't capture the initial handshake, you can't inject authenticated chunks.

As soon as you use an endpoint pair shared secret, you can overcome this limitation,
since even if the attacker sees the RANDOM parameters, the attacker can not authenticate
chunks as long as the attacker does not know the endpoint pair shared keys.
>  
> Now if we assume a Man in the middle exist who can sniff the packets and spoof the Peer IP address.
OK.
> My question is for the initial SCTP handshake when NULL Key (Shared key id 0) is used how can SCTP protect from an Man In the middle which can inject packets required to be authenticated , for example ABORT. In such case this MTM can Abort the establishment of association even before the Master Secret and an endpoint pair shared key is derived from DTLS handshake.
That is correct. But please note that the attacker must be on path. The question is how hard is
it for an on path attacker to drop packets when is is able to read packets and send spoofed packets.
My understanding is that it is not hard to do so when you are already on path, can read and
spoof packets.
>  
> Is there something I am missing here or SCTP is vulnerable during this initial phase of DTLS over SCTP link setup.
No, that is true. Please note that this is the same of TLS/TCP. Compared to TLS/TCP, DTLS/SCTP is
a bit better protected, since you can inject TCP RST segments at any time and you only need to guess
the sequence number. For SCTP you can't do this if you require most of the chunk to be authenticated.

Does this answer your question?

Best regards
Michael
>  
> Best Regards,
>  
> Sidhartha Pant
>  
> Huawei Technologies India Pvt. Ltd.
> Survey No. 37, Next to EPIP Area, Kundalahalli, Whitefield 
> Bengaluru-560066, Karnataka
> Tel: + 91-80-49160700 Ext 71594 II Mob: +919886174874 Email: 
> [email-masked]