[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: exchange type 6?
Hi Derrell,
The reserved number in question is in the scope of Mode-Cfg (which is quite
independant of Xauth, and serves a completely different function). The Xauth
protocol uses the Mode-Cfg protocol as a transport mechanism, and only uses
magic numbers from the "mutually consenting parties" range. I know that
most people who have implemented mode-cfg, have also implemented Xauth, but
some haven't, and some might not use Xauth in the future but keep mode-cfg.
If you have security concerns about the Xauth protocol, I'll attempt to
address them.
I've heard of some concerns with the Xauth along the lines of.
1 - It complicates IKE, which is complicated enough by itself, so there's a
good chance implementors will make mistakes, and render IKE less secure.
- OK, noted.
2 - It promotes the use of pre-shared keys, which is obviously less secure
than using a PKI.
- TRUE, but some customers want this, and are willing to manage the risks
involved
3 - It SHOULD NOT be used with pre-shared keys + Main Mode, as one would not
have a choice but to use group shared keys which are susceptible to social
engineer attacks.
- I could change this to MUST NOT if there was concensus among the Xauth
vendors, as I don't believe anyone actually uses this (other than for
testing purposes).
These concerns are already documented in the Security Considerations section
of the draft. I truly hope that Xauth gets replaced in the future by
something more appropriate (i.e. GetCert, PIC, Hybrid, CRACK, etc...)....
mostly because I'm tired of having this very political discussion. However,
customers *want* to have legacy authentication w/ pre-shared keys, until
PKIs are a more viable solution, and it was the best protocol we had at the
time, so we implemented it. Now we've got it, our business partners have
it, and it works exactly as it was intended to work.
So, if you know of any *serious* security problems (other than the heebee
geebees) with the Xauth protocol (assuming it is properly implemented), then
please post it to mailto:ietf-xauth@vpnc.org , as most of the people on that
list have a vested interest in any such problems.
Note: If anyone wishes to reply based on the "Security Considerations" of
Xauth, please do so on the xauth mailing list noted above (which is also
cc'd), as the IPsec mailing list is not really the forum.
Thanks,
Stephane.
----- Original Message -----
From: "Derrell Piper" <ddp@electric-loft.org>
To: <wprice@cyphers.net>; <ipsec@lists.tislabs.com>
Sent: Thursday, February 22, 2001 9:58 AM
Subject: Re: exchange type 6?
> Will,
>
> I just don't agree with allocating a reserved number to Config/XAUTH.
> XAUTH was not adopted because it has serious security problems. We did
> think about this. The problem is that there's been essentially no
progress
> on adopting a viable alternative (e.g. CRACK or Hybrid) so people continue
> to use what they've got. However, it's our charter to provide secure
> protocols and standardizing anything less is unacceptable to some of us.
>
> Derrell
>
>
References: