4 ms·

I'm too stupid to understand the crypto technicalities. Is this really a good solution? Or embrace, extend, extinguish targeted on Wireguard? The paper abstrac

I'm too stupid to understand the crypto technicalities. Is this really a good solution? Or embrace, extend, extinguish targeted on Wireguard? The paper abstract mentions a "cookie"-like concept, and from websec I know that cookies are not always the optimal solution and historically cookie implementations had a lot of attack surface. EDIT: Seems to come from German Max-Planck Institute which is funded by German government.

gzer0 4y ago
The article refers to a "cookie" as a "biscuit" "Lacking a reliable way to detect retransmission, we remove the replay protection mechanism and store the responder state in an encrypted cookie called “the biscuit” instead. Since the responder does not store any session-dependent state until the initiator is interactively authenticated, there is no state to disrupt in an attack." Both WG and PQWG are vulnerable to state disruption attacks; they rely on a timestamp to protect against replay of the first protocol message. An attacker who can tamper with the local time of the protocol initiator can inhibit future handshakes, rendering the initiator’s static keypair practically useless. The use of the insecure NTP protocol is the reason for the "cookie" / "Biscuit" mechanism.
- Fnoord 4y ago
  AFAIK a NTP client doesn't accept a value which highly differentiates from the current time. At least, not without user interaction. Does that render this attack less likely?
  - sevenoftwelve 4y ago
    Rosenpass author here. It does yes. But it is a mitigation, not a real fix. An attacker could still just speed up time. Although not being able to produce a KillPacket for the year three thousand is a good thing :)
Fnoord 4y ago
> EDIT: Seems to come from German Max-Planck Institute which is funded by German government. On the Github repo it says: "Supported by Funded through NLNet with financial support for the European Commission's NGI Assure program." On the website it says: "Funded through NLnet with financial support from the European Commission's NGI Assure program."
- bflesch 4y ago
  On the paper it says MPI
  - touisteur 4y ago
    European program funding a University team, no?
wucke13 4y ago
One of the people involved works for the MPI as a crypto researcher, however the project itself was funded by NLnet
sevenoftwelve 4y ago
Rosenpass author here; I myself am independent, thus funding by NLNet. We have some project participants who are Freelancers; two of my co-authors are employed at research institutes. One of my co authors is employed at MPI-SP. The cookie thing is a defense against WireGuard CVE-2021-46873; the attack is in my view not bad enough to get rid of the WireGuard protocol. WG is still the standard for pre-quantum VPN implementations. Rosenpass also needs to use post-quantum crypto-primitives that need a lot of cpu and memory resources. Rosenpass and WireGuard work together; Rosenpass runs in userspace and gives keys to WireGuard so we do not plan to replace it any time. It would be possible to apply the biscuit mechanism to classical WireGuard; unfortunately that would cause a protocol incompatibility. I am not sure if they are going to take that path.

gzer0 4y ago

The article refers to a "cookie" as a "biscuit" "Lacking a reliable way to detect retransmission, we remove the replay protection mechanism and store the responder state in an encrypted cookie called “the biscuit” instead. Since the responder does not store any session-dependent state until the initiator is interactively authenticated, there is no state to disrupt in an attack." Both WG and PQWG are vulnerable to state disruption attacks; they rely on a timestamp to protect against replay of the first protocol message. An attacker who can tamper with the local time of the protocol initiator can inhibit future handshakes, rendering the initiator’s static keypair practically useless. The use of the insecure NTP protocol is the reason for the "cookie" / "Biscuit" mechanism.

Fnoord 4y ago
AFAIK a NTP client doesn't accept a value which highly differentiates from the current time. At least, not without user interaction. Does that render this attack less likely?
- sevenoftwelve 4y ago
  Rosenpass author here. It does yes. But it is a mitigation, not a real fix. An attacker could still just speed up time. Although not being able to produce a KillPacket for the year three thousand is a good thing :)

Fnoord 4y ago

> EDIT: Seems to come from German Max-Planck Institute which is funded by German government. On the Github repo it says: "Supported by Funded through NLNet with financial support for the European Commission's NGI Assure program." On the website it says: "Funded through NLnet with financial support from the European Commission's NGI Assure program."

bflesch 4y ago
On the paper it says MPI
- touisteur 4y ago
  European program funding a University team, no?

wucke13 4y ago

One of the people involved works for the MPI as a crypto researcher, however the project itself was funded by NLnet

sevenoftwelve 4y ago

Rosenpass author here; I myself am independent, thus funding by NLNet. We have some project participants who are Freelancers; two of my co-authors are employed at research institutes. One of my co authors is employed at MPI-SP. The cookie thing is a defense against WireGuard CVE-2021-46873; the attack is in my view not bad enough to get rid of the WireGuard protocol. WG is still the standard for pre-quantum VPN implementations. Rosenpass also needs to use post-quantum crypto-primitives that need a lot of cpu and memory resources. Rosenpass and WireGuard work together; Rosenpass runs in userspace and gives keys to WireGuard so we do not plan to replace it any time. It would be possible to apply the biscuit mechanism to classical WireGuard; unfortunately that would cause a protocol incompatibility. I am not sure if they are going to take that path.