RE: FW: DISCUSS: draft-ietf-ipcdn-bpiplus-mib-14

Thanks Steve, we will scope the text showing the lack of robustness for
targeted attacks as you pointed, or even removing it on favor or a more
encouraging text for stronger encryption.

Thanks

Eduardo


-----Original Message-----
From: Steven M. Bellovin [mailto:[email protected]] 
Sent: Tuesday, October 05, 2004 12:49 PM
To: Jean-Francois Mule
Cc: Russ Housley; [email protected]; [email protected]; Eduardo Cardona;
Richard Woundy @ Comcast; Eric Rosenfeld; Oscar Marcia; Greg White
Subject: Re: [ipcdn] FW: DISCUSS: draft-ietf-ipcdn-bpiplus-mib-14 


That address most of my concerns.  But I also said this:

  The Security Considerations section says
  
      The time to crack DES could be additionally
      mitigated by a compromised value for the TEK lifetime and Grace
Time
      (up to a minimum of 30 minutes for the TEK lifetime, see
      Appendix A [1]).
  
  That's only partially correct.  These keys are confidentiality keys; 
  they're still valuable even after they're no longer in active use, 
  because they can be used to decrypt old traffic.  (By contrast, old 
  authentication keys are useless to an attacker.)
  
You need to strengthen your text; while frequent key changes help, an
attacker can often select what to attack.  For example, email checking
is generally timer-driven; someone monitoring the link can easily spot
an eamil session by noticing the periodicity.  For example, in the
middle of the night, when there's little email traffic (except, of
course, for the daily spam load), there will be a set of very similar
(in length and timing) packets in each direction, every N minutes, where
N is probably in the range 5-15 minutes.  Select the confidentiality key
for this period, attack it, and recover the user's email password.  For
that attack, a key lifetime of 30 minutes or 30 days is the same -- it's
a targeted attack.