Matasano Chargen - Latest Comments in Adam Bozanich Did Not Uncover An NSA IPsec Conspiracy: Diffie Hellman Parameter Validation Explained

Re: Adam Bozanich Did Not Uncover An NSA IPsec Conspiracy: Diffie Hellman Parameter Validation Explained

JB — Thu, 04 Jun 2009 14:59:54 -0000

" When Alice and Bob run DH, they have to be careful not to allow any of the parameters —- p, g, A, or B —- be zero or one mod p. "

Well, p is always going to be zero mod p!

Re: Adam Bozanich Did Not Uncover An NSA IPsec Conspiracy: Diffie Hellman Parameter Validation Explained

Peder Grass — Mon, 07 Jul 2008 14:20:50 -0000

It's intresting to know Im not alone with a brain in this weird world.

Re: Adam Bozanich Did Not Uncover An NSA IPsec Conspiracy: Diffie Hellman Parameter Validation Explained

Andy 2 — Fri, 28 Sep 2007 21:36:50 -0000

In addition to 1970's crypt and 1980's chroot, the 1990's ISP now contributes...

Rainbow tables visualized:

http://ourworld.compuserve.com/homepages/citygl...

Re: Adam Bozanich Did Not Uncover An NSA IPsec Conspiracy: Diffie Hellman Parameter Validation Explained

Nate — Fri, 28 Sep 2007 14:02:38 -0000

I know! We'll add a salt to the DH derived secret like this:

MD5("barfing bunions" || secret)

Then rainbow tables cannot be used to attack it. Also, in addition to 1970's Unix crypt being a new discovery, apparently the 1980's chroot break code is also new:

http://kerneltrap.org/Linux/Abusing_chroot

Re: Adam Bozanich Did Not Uncover An NSA IPsec Conspiracy: Diffie Hellman Parameter Validation Explained

djm — Tue, 25 Sep 2007 19:35:41 -0000

Parameter validation is actually recommended in RFC 2141 (s. 2.3.1.1) and anyone implementing DH needs to do it, so it isn't fair to blame the protocol here.

I found and reported this problem to the security contacts of the ipsec-tools and openswan people last May, neither bothered to fix it. Some more details at: http://article.gmane.org/gmane.comp.encryption....

Of course I was being very web 1.0 about it, I guess I should have just blogged it.

Re: Adam Bozanich Did Not Uncover An NSA IPsec Conspiracy: Diffie Hellman Parameter Validation Explained

Adam Bozanich — Tue, 25 Sep 2007 18:59:40 -0000

and what have we learned?

That we should be more careful about blog titles? :)

Re: Adam Bozanich Did Not Uncover An NSA IPsec Conspiracy: Diffie Hellman Parameter Validation Explained

Matt — Tue, 25 Sep 2007 14:41:21 -0000

IKE is probably one of the worst protocols ever to come out of the IETF

Ferguson and Schneier's paper on IPSec, including IKE, from a protocol design standpoint:

http://schneier.com/paper-ipsec.html

I also know from first-hand experience that a couple of the existing implementations have disastrously scary codebases.

Re: Adam Bozanich Did Not Uncover An NSA IPsec Conspiracy: Diffie Hellman Parameter Validation Explained

Erin Ptacek — Tue, 25 Sep 2007 12:36:40 -0000

Thanks for the tip, hon!