[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Another pothole in ISAKMP/Oakley
>
>I'll agree that encryption mode is more secure but how is this attack made
>against signature mode (or pre-shared key for that matter)?
>
> HASH_I = prf(SKEYID, g^xi | g^xr | CKY-I | CKY-R | SAp | IDii)
> HASH_R = prf(SKEYID, g^xr | g^xi | CKY-R | CKY-I | SAp | IDii)
>
>This is signed in signature mode (and generated directly in pre-shared key
>mode). Since both exponentials are there how can any man-in-the-middle change
>them without each party being aware of that?
>
> Dan.
>
Dan is correct. The inclusion of g^xr and g^xi in HASH solves the problem
in all the modes. This is no particular advantage of the encryption mode.
It is an advantage of having the same HASH in all modes and all include
the exponents. Befoere doing that, draft-01 was susceptible to this problem.
Hugo