1. Integrating Identity based Cryptosystem (IBC) with CGA in Mobile IPv6 draft-cao-mipshop-ibc-cga-00.txt Zhen Cao Hui Deng IETF #67

2. Outline Issues with CGA-based drafts Issues with address ownership problem On our draft: IBC-CGA

3. Problem with CGA-based drafts: Quote from RFC 3972 Section 7.4 A strong cautionary note has to be made about using CGA for purpose other than SEND –“ Each protocol MUST define its own type tag values as explained ” : to defend against “ related protocol ” attacks –“ The minimum RSA key length of 384 bits may be too short for many applications and the impact of key compromise on the particular protocol must be evaluated ” : more considerations are necessary –“ If the goal is not to verify claims about IPv6 addresses, CGA signatures are probably not the right solution ” : not a sufficient security mechanism

4. Several attacks to CGA AttacksBig Integer Factoring Hash collision Related protocol attack Auto-configure Cost for attackers Expensive O(2^(n/2)) Medium O(2^(59+H)) LowestLow O(2^(16*Sec)) HazardHolds unless key changes Holds until address changes Reply attackHolds unless attackers being discovered DefenseLonger keyHash extension Define ‘ Type tag ’ Trust relationship n: public key length H: hash extension provided by CGA

5. Address ownership problem By signing a message with a private key, the CGA verifier asserts that: –(a) the address is owned by somebody –(b) the message is coming from the address owner It cannot tell whether the address owner is a trusted party. How to address this trust relationship problem is an issue.

6. What is IBC ? Identity Based Cryptosystem: a cryptosystem in which the public key is retrieved from an identity of the entity, and the private key is securely distributed by the Key Distribution Center. –K + = F (pub, ID), pub is publicly known –K - = F ’ (sec, ID), sec is known only to KDC and the client Is not new to IETF

7. What is IBC-CGA ? Using IBC to broke trust relations through a trusted third party (e.g. Key Distribution Center) IBC-CGA –MN registers IBC-ID on KDC, get K + and K - –Get CGA: CGA = F (K+) –Signature: CGA-Sign (K -, M) –IBC-CGA parameter: containing an IBC-ID instead of a public key –Trust: by verifying the CGA signature, the verifier can convince whether the sender is an entity trusted by the KDC as well as address ownership

8. Comparison PKICGAIBCIBC-CGA Infrastructure CANoneKDC Authenticity Signature Trust relationship Rooted in CA NoneRooted in KDC Address ownership NoneYesNoneYes Efficiency Not goodOKIt depends

9. Acknowledgement Discussion with Christian Vogt, James Kempf, Wassim Haddad in the ML, thanks for your comments and advice.

10. Thanks for your attention Questions ?