Secure channels over TCP/IP

Re:Secure channels over TCP/IP by agwa on Tuesday July 07, 2015 @09:42PM (#9849293)

You wouldn't want to use this. The key exchange is vulnerable to replay and identity misbinding attacks. To fix the replay attack, you also need to sign a nonce from the peer (or its ephemeral public key) to prove that the message is fresh. To fix the identity misbinding attack, you also need to sign the identity of the peer. Then it's probably secure, but the protocol would lack identity hiding. You really want a key exchange protocol like SIGMA, which is secure and provides identity hiding.

See the following presentation, which presents insecure key exchange protocols (the key exchange from the article is on page 4) while building up to SIGMA: https://www.ietf.org/proceedings/52/slides/ipsec-9.pdf

As you can see, this stuff is hard and you really shouldn't be designing your own. CurveZMQ (basically, DJB's CurveCP over TCP) is probably a better choice if you want a NaCl-based secure channel. CurveZMQ also happens to be pretty well documented if you want to learn about what it takes to design a secure protocol: http://curvezmq.org/page:read-the-docs

[ Parent | on HN ]

Re:Secure channels over TCP/IP by tptacek on Friday July 10, 2015 @01:32AM (#9862438)

Didn't CodesInChaos document a misbinding attack against CurveCP, too?

[ Parent | on HN ]

Re:Secure channels over TCP/IP by agwa on Saturday July 11, 2015 @12:24PM (#9870365)

He found problems with the identity binding where if even a short-term key was compromised, it would allow impersonation attacks in the future[1]. That's a poor way to handle failure (and it's fixed in CurveZMQ with the minor changes he proposed) but it requires a key compromise to exploit so it's not as bad as a straight-up misbinding attack which any MitM can exploit.

[1] https://codesinchaos.wordpress.com/2012/09/09/curvecp-1/

[ Parent | on HN ]