[Mipshop] Re: AD review of draft-ietf-mipshop-handover-key

[Jari Arkko <jari.arkko at piuha.net>]

James,

>> The MN can reuse the key pair on different
>> access routers but MUST NOT use the key pair for
>> any other encryption or for signature operation.
>
> I hope this does not imply that the same key pair could not be
> used for SEND. Essentially, this would mean that SEND and
> FMIP are incompatible. OTOH, I see no reason why this should
> apply to anything involving the CGA address itself. Suggested
> rewrite:
>
> The MN can reuse the key pair on different
> access routers but MUST NOT use the key pair for
> any encryption or signature beyond operations
> involving the given CGA address (such as Neighbor
> Advertisements for the given address, secured
> with SEND).
>
> jak>> The handover key encryption key should not be used for any
> authentication operation including SEND. A separate key was introduced
> for encrypting because RSA has a vulnerability if the same key is used
> for both encryption and authentication. I can modify it to:
>
> jak>> The MN can reuse the key pair on different
> access routers for encrypting a handover key
> but MUST NOT use the key pair for
> any other encryption or signature operations, especially
> for authentication with SEND.

This is very problematic. If I understand this correctly, it means that
the MN can pick a key pair and address and defend them in the
RtPrSol, but is unable to do so for regular ND operations on the
link. And you need to use ND operations on the link. Also, at
the same time any use of the given care of address with CGA
based techniques (SHIM6, RFC 4866) becomes impossible.

Did I get this correctly? If yes, I think we need to do something
about it.

Is the RSA vulnerability an issue for the key in question? What
if there was key pair P that was used to derive the care of address,
and to certify key pair Q. Both P and Q were included in RtPrSol,
and only Q would be used for encryption in RtPrAdv? But I'm
just thinking aloud here...

> In which format? Can you specify this more explicitly?
>
> jak>> I'll look into this. Do you have any preferences about the format?

No. I don't remember if RFC 4866 had something similar, you may
want to copy from there if it did.

Jari



_______________________________________________
Mipshop mailing list
Mipshop at ietf.org
https://www1.ietf.org/mailman/listinfo/mipshop