editor: Stephen Farrell, Draft-ietf-sacred-protocol-bss-04.txt editor: Stephen Farrell, stephen.farrell@baltimore.ie 55th IETF, November 2002

Changes from –03 Replaced SASL-MD5 with DIGEST-MD5 everywhere Updated appendix B and other BEEP issues according to Marshall Rose's Oct 6th recommendations Applied all but three "editorial corrections" raised on list Added a recommendation to download prior to modify Fixed AuthXXXType extensibility as suggested by Gareth Richards

Issues still open “Rejected” issues from list: Adding upload response message Use of CDATA needed? (BEEP question) “More editorial” stuff from Magnus: “ok,ok,ok” Some clarifications (Manning) “tuning” & clarity wrt BEEP & auth New security issue: binding of separate authentications

Compound Authentication Issue draft-puthenkulam-eap-binding-00.txt describes how the lack of a strong binding between compound authentications (esp. server then tunnelled client) leaves open the possibility of “MITM” attacks, which, if the same client authenticator (e.g. password) is badly used in one context, can be real attacks. Raised wrt EAP, but applies here too unfortunately.

Problem DIGEST-MD5 password used for sacred and (non TLS) web access with web server (WS) Attacker masquerades as WS to client. Client connects to WS. Attacker WS connects to credential server (CS) CS issues challenge to Attacker Attacker passes back challenge to Client Client sends response to attacker Game over

Danger!!! Too late. Client Web Server Credential Server Client Digest-MD5 (clear) Server-auth TLS, then Digest-MD5 (same pwd) Too late. Client Attacker Credential Server Server-auth TLS, DIGEST-MD5 challenge Digest-MD5 (clear) Finish Digest-MD5 Run away with private key

Fix? As a generic attack it arguably ought to be fixed generically (e.g. show a way to securely use SASL within TLS) Specific fix: Modify use of DIGEST-MD5, e.g. make password include “sacred:” or hash(uname) or something? (bar-BoF anyone?) Guidance: If the client authenticator is only used for sacred then the attack doesn’t arise => recommend that the DIGEST-MD5 password only be used for sacred and point at (or describe: “dependency--”) the attack scenario in the security considerations section? EKE, SRP etc. Been there, done that. :-(

Plan -05 to be done this week Only real work is new security considerations text (if that’s how we fix the compound authentication issue) Proposed text to list this week