[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

IKE negotiation/rekeying problem with RSIP




There is a possible problem IKE initiation/rekeying over RSIP. If two inner
computers use an RSIP gateway to establish IPsec sessions to one
destination, the destination computers will see 2 IKE phase1's from the
gateway. If the destination computer ever needs to rekey a phase 2 or
negotiate a new phase 2, he may select an incorrect phase 1 to negotiate
with.

Here is an example:

	A ---> +---------+ 
		 | Gateway | ---> C
	B ---> +---------+

A negotiates a phase 1 with C using the gateway    (called phase 1a)
A negotiates a phase 2 with C using the phase 1a   (called phase 2a)

B negotiates a phase 1 with C using the gateway    (called phase 1b)
B negotiates a phase 2 with C using the phase 1b   (called phase 2b)

The lifetime of phase 2a is about to expire; C wants to negotiate a new SA
before phase 1a expires completely. Since phase 1a is established to G (the
gateway), C looks in his state table for a phase 1 he could re-use to G, he
finds Phase1b and uses it to negotiate.

The new phase2 negotiation is encrypted end-to-end from B to C. The gateway
cannot do anything about it, he forwards the packets based on the cookies in
the header. B will receive a negotiation intended to go to A and may or may
not accept it.

I would note that this example is likely to happen. In IKE the responder may
have a phase 2 SA lifetime lower than the initiator without the initiator
knowing. In this case, the responder will be the one re-keying and causing
the problem.

This problem could also occur frequently if the initiator only negotiates
SA's with very specific ports/protocols. The destination could be unable to
reply back since all it's SA's are negotiated to the wrong computer inside
the gateway.

I also note that the phase 1 selection process varies from an IKE
implementation to another.

I don't have any simple solution that come to mind, maybe this is out of
scope or we can live with this.

Ylian Saint-Hilaire
INTEL - Communication Architecture Labs


Follow-Ups: