-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 This is in response to the mail of mthumannat_private from ERNW Gmbh posted on 2003-Apr-23: At 11:35 23/04/2003 +0100, Michael Thumann wrote: >we would like to announce the publication of a proof of concept paper >'PSK cracking using IKE Aggressive Mode'. Paper can be downloaded from >www.ernw.de/download/pskattack.pdf . The mail itself can be found at http://www.securityfocus.com/archive/1/319487 This text can be found at http://www.cisco.com/warp/public/707/cisco-sn-20030422-ike.html IKE (Internet Key Exchange) is used during Phase 1 and Phase 2 of establishing an IPSec connection. Phase 1 is where the two ISA KMP (Internet Security Association and Key Management Protocol) peers establish a secure, authenticated channel with which to communicate. This is called the ISAKMP Security Association (SA). "Main Mode" and "Aggressive Mode" each accomplish a Phase 1 exchange. Each generates authenticated keying material from an ephemeral Diffie-Hellman exchange. Every participant in IKE must possess a key which may be either pre-shared (PSK) or a public key. There are inherent risks to configurations that use pre-shared keys which are exaggerated when Aggressive Mode is used. When responding to IPSec session initialization, Cisco IOSŪ software may use Aggressive Mode even if it has not been explicitly configured to do so. Cisco IOS software initially tries to negotiate using Main Mode but, failing that, resorts to Aggressive Mode. Using Aggressive Mode with pre-shared keys is the least secure option. In this particular scenario, it is possible for an attacker to gather all necessary information in order to mount an off-line dictionary (brute force) attack on the pre-shared keys. The detailed analysis of the attack is given in the article by John Pliam. The article is located at http://www.ima.umn.edu/~pliam/xauth/. Although this article is about Aggressive Mode, the thread referenced below also contains references to Main Mode. Please note that this attack method has been known and discussed within the IETF IPSec Working Group. You can find the thread at http://www.vpnc.org/ietf-ipsec/99.ipsec/thrd2.html#01451 (Subject: Weak authentication in Xauth and IKE). The IPSec Working Group has understood and acknowledged this attack avenue, but has deemed that this is an acceptable risk. There are public information-gathering tools which target IPSec session initiation and brute-force the pre-shared key. One of them can be found at http://ikecrack.sourceforge.net/ The most exposed users are those who use IPSec to connect to internal resources across a hostile network (for example, a sales person visiting a customer). The entire session may be intercepted on the hostile network and manipulated while the user is unaware of such activity. Note that the recorded session (the one that was used to discover PSK) cannot be decrypted. It is still protected by the ephemeral Diffie-Hellman key exchange. An adversary can either use a pre-shared key to impersonate a trusted user and connect to the protected network, or it can mount an active Man-in-The-Middle (MiTM) attack on any new session. Another high-risk scenario is group pre-shared keys, that is, a single shared key is assigned to all dial-in users. Please note that the same class of attack is possible even if Xauth (Extended Authentication) is used. This is because Xauth is performed after Phase 1 is completed and, for this attack, an adversary needs only a packet from Phase 1. Furthermore, after the pre-shared key has been discovered, an adversary can mount an active MiTM attack on Xauth. The outcome depends on the exact authentication method used in Xauth. Mitigation of this risk is to use, as long as practical, strong pre-shared keys, and to change them frequently. In Cisco IOS software, the PSK can be up to 128 characters in length. According to some estimates, one character carries from 1.3 to up to 4 bits of entropy. This means that the password can have, at maximum, anywhere from 166 to 512 bits of entropy. The length of the PSK should be determined by your security policy. Gaus -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.3 iQA/AwUBPqbthnsxqM8ytrWQEQKQWQCg+wMymcQM1/u4xW30utf8I8Cr9lcAoKlW pUqNA1rS3fT4kjD58GVJ5sZ/ =2/U9 -----END PGP SIGNATURE----- ============== Damir Rajnovic <psirtat_private>, PSIRT Incident Manager, Cisco Systems <http://www.cisco.com/go/psirt> Telephone: +44 7715 546 033 200 Longwater Avenue, Green Park, Reading, Berkshire RG2 6GB, GB ============== There are no insolvable problems. The question is can you accept the solution?
This archive was generated by hypermail 2b30 : Wed Apr 23 2003 - 15:03:15 PDT