Subject: [anonsec] Re: Why use self-signed certs at all?

From: paul.hoffman at vpnc.org (Paul Hoffman / VPNC)
Date: Tue Nov 23 08:43:45 2004

[[ Forwarded for Tero Kivinen, who cannot post to the list because of 
some list admin hassles... ]]

>Paul Hoffman writes:
>>  At this point, I believe that that charter can better served with
>>  shared secrets that aren't secret. It would be easier to fit into
>>  IKEv1 and/or IKEv2, would cause faster setup for SAs, and would not
>>  encumber all of the baggage that made the PKI4IPSEC WG required in
>>  the first place.
>
>I think (self-signed) certificates provides much more than widely
>known pre-shared secrets.
>
>1) It allows channel bindings also over the lifetime of the connection
>    not simply lifetime of the SA, and this even without support for
>    rekeying, i.e. it allows you to verify that the reconnected host
>    who is doing rekeying of the given SA is really the same host than
>    what there was last time. With pre-shared secrets the attacker
>    could simply connect you and send initial contact notification or
>    send delete notifications to the given SAs, and you do not have any
>    way of knowning whether to belive those (i.e. did the other end
>    really reboot and lost its state or is this an attacker). With the
>    certificates you can verify that the public key of the connections
>    must be same.
>
>2) It allows the entity to verify that the host is same that it was
>    last week when he last time connected to it (i.e. you can store the
>    public key of the other host and check it each time, just like the
>    secsh does now).
>
>3) It allows incremental upgrade path to better security, i.e. the ISP
>    could start first with self-signed certificates. Parties connecting
>    to the ISPs routers would store the public key and check they are
>    same before trusting TCP resets from that node. Later parties could
>    start storing the public keys to the memory, and only allow
>    connections using that public key etc. Then the ISP could create
>    its own CA and convert all self-signed certificates to certificates
>    signed by that CA. The public keys would stay same, so parties
>    connecting to it would not notice any difference, except that the
>    actual bits in the certificate would change. Then the partner ISP
>    could simply configure the CA that the other ISP is using to their
>    routers, and suddenly they would have full secure IPsec.
>
>4) Self-signed certificates allows system to use both normal IPsec
>    connections and BTNS connectins in the same time without
>    restricting the normal IPsec connections to specific IP-addresses
>    only, or using the aggressive mode (note, that you cannot use
>    random IP address in IKEv1 when using main mode and having
>    different pre-shared-secrets).
>--
>[email-masked]

--Paul Hoffman, Director
--VPN Consortium