Unknown Key-Share Attacks on Uses of TLS with the Session Description Protocol (SDP)
RFC 8844

• Status
• IESG evaluation record
• IESG writeups
• Email expansions
• History

• Versions
• 00
• 01
• 02
• 03
• 04
• 05
• 06
• 07



Internet Engineering Task Force (IETF)                        M. Thomson
Request for Comments: 8844                                   E. Rescorla
Updates: 8122                                                    Mozilla
Category: Standards Track                                   January 2021
ISSN: 2070-1721

 Unknown Key-Share Attacks on Uses of TLS with the Session Description
                             Protocol (SDP)

Abstract

   This document describes unknown key-share attacks on the use of
   Datagram Transport Layer Security for the Secure Real-Time Transport
   Protocol (DTLS-SRTP).  Similar attacks are described on the use of
   DTLS-SRTP with the identity bindings used in Web Real-Time
   Communications (WebRTC) and SIP identity.  These attacks are
   difficult to mount, but they cause a victim to be misled about the
   identity of a communicating peer.  This document defines mitigation
   techniques that implementations of RFC 8122 are encouraged to deploy.

Status of This Memo

   This is an Internet Standards Track document.

   This document is a product of the Internet Engineering Task Force
   (IETF).  It represents the consensus of the IETF community.  It has
   received public review and has been approved for publication by the
   Internet Engineering Steering Group (IESG).  Further information on
   Internet Standards is available in Section 2 of RFC 7841.

   Information about the current status of this document, any errata,
   and how to provide feedback on it may be obtained at
   https://www.rfc-editor.org/info/rfc8844.

Copyright Notice

   Copyright (c) 2021 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (https://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Table of Contents

   1.  Introduction
   2.  Unknown Key-Share Attack
     2.1.  Limits on Attack Feasibility
     2.2.  Interactions with Key Continuity
     2.3.  Third-Party Call Control
   3.  Unknown Key-Share Attack with Identity Bindings
     3.1.  Example
     3.2.  The "external_id_hash" TLS Extension
       3.2.1.  Calculating "external_id_hash" for WebRTC Identity
       3.2.2.  Calculating external_id_hash for PASSporT
   4.  Unknown Key-Share Attack with Fingerprints
     4.1.  Example
     4.2.  Unique Session Identity Solution
     4.3.  The external_session_id TLS Extension
   5.  Session Concatenation
   6.  Security Considerations
   7.  IANA Considerations
   8.  References
     8.1.  Normative References
     8.2.  Informative References
   Acknowledgements
   Authors' Addresses

1.  Introduction

   The use of Transport Layer Security (TLS) [TLS13] with the Session
   Description Protocol (SDP) [SDP] is defined in [FINGERPRINT].
   Further use with Datagram Transport Layer Security (DTLS) [DTLS] and
   the Secure Real-time Transport Protocol (SRTP) [SRTP] is defined as
   DTLS-SRTP [DTLS-SRTP].

   In these specifications, key agreement is performed using TLS or
   DTLS, with authentication being tied back to the session description
   (or SDP) through the use of certificate fingerprints.  Communication
   peers check that a hash, or fingerprint, provided in the SDP matches
   the certificate that is used in the TLS or DTLS handshake.

   WebRTC identity (see Section 7 of [WEBRTC-SEC]) and SIP identity
   [SIP-ID] both provide a mechanism that binds an external identity to
   the certificate fingerprints from a session description.  However,
   this binding is not integrity protected and is therefore vulnerable
   to an identity misbinding attack, also known as an unknown key-share
   (UKS) attack, where the attacker binds their identity to the
   fingerprint of another entity.  A successful attack leads to the
   creation of sessions where peers are confused about the identity of
   the participants.

   This document describes a TLS extension that can be used in
   combination with these identity bindings to prevent this attack.

   A similar attack is possible with the use of certificate fingerprints
   alone.  Though attacks in this setting are likely infeasible in
   existing deployments due to the narrow preconditions (see
   Section 2.1), this document also describes mitigations for this
   attack.

   The mechanisms defined in this document are intended to strengthen
   the protocol by preventing the use of unknown key-share attacks in
   combination with other protocol or implementation vulnerabilities.
   RFC 8122 [FINGERPRINT] is updated by this document to recommend the