Subject: [anonsec] Binding & shared non-secret

From: Black_David at emc.com ([email-masked])
Date: Fri Nov 19 16:22:19 2004

> One thing that this "universally-shared non-secret" doesn't do is allow
> for channel bindings as a way to prevent MITMs in the IPsec channel.

Not exactly.  Binding to that secret has no value because the MITM
knows the secret.  Binding to an IKE DH exchanges based on that
secret has value because the MITM can't force the two DH exchanges
involved to produce the same result.

> Also, this prevents any leap-of-faith sharing of self-signed certs.

IMHO, that's a "nice to have" as opposed to an "absolute requirement"
for BTNS.  I can see utility in an approach that does the
leap-of-faith on every setup between two peers as opposed to just
the first one.  For channel binding, as long as the resulting SA
can be used in a channel binding, the MITM attack on leap-of-faith
can be detected afterwards via suitably modified higher level
authentication.

Thanks,
--David
----------------------------------------------------
David L. Black, Senior Technologist
EMC Corporation, 176 South St., Hopkinton, MA  01748
+1 (508) 293-7953             FAX: +1 (508) 293-7786
[email-masked]        Mobile: +1 (978) 394-7754
----------------------------------------------------

---

From: Nicolas.Williams at sun.com (Nicolas Williams)
Date: Fri Nov 19 21:01:26 2004

> involved to produce the same result.

Then we're back to the robustness issues I mentioned.

> for BTNS.

Agreed.