Subject: [anonsec] Channel Bindings

From: Black_David at emc.com ([email-masked])
Date: Mon Nov 22 09:12:31 2004

> >>Specfcifically, exporting bits from the DH exchange to a higher 
> >>layer might conflict with the FIPS 140-2 requirements for key 
> >>protection, requirements that one would like to see in a crypto 
> >>module supporting IPsec. It would depend on how the bits are 
> >>exported, what sort of functions the module provided at its 
> >>interface, and how CHAP was implemented.
> >
> >That would only be true for bits from the DH secret. If I understand 
> >channel binding correctly, you woudn't need to export the secret, 
> >only the publics that were passed in messages 3 and 4 (in IKEv1). 
> >That is, the iSCSI (or whatever) authentication could mix in those 
> >publics with the protocol-specific auth to be sure that the SA 
> >established was between Alice and Bob without Mallory. "I used these 
> >two things to get my DH secret" is enough.
> 
> I was assuming from David's text that he wanted to use bits from the 
> output of the PRF that we employ in IKE to mix with the higher level 
> authentication secret to bind the channel.  Let's ask David what he 
> had in mind.

I was thinking about bits from the secret, but bits from both public
values involved (g^x, g^y) suffice along with the "I used these two
things to get my DH secret" meaning/assertion (implementation has
to make sure that the latter assertion holds).

Thanks,
--David
----------------------------------------------------
David L. Black, Senior Technologist
EMC Corporation, 176 South St., Hopkinton, MA  01748
+1 (508) 293-7953             FAX: +1 (508) 293-7786
[email-masked]        Mobile: +1 (978) 394-7754
----------------------------------------------------