Unknown Key-Share Attacks on Uses of TLS with the Session Description Protocol (SDP)
RFC 8844
Document | Type |
RFC - Proposed Standard
(January 2021; No errata)
Updates RFC 8122
|
|
---|---|---|---|
Authors | Martin Thomson , Eric Rescorla | ||
Last updated | 2021-01-18 | ||
Replaces | draft-thomson-mmusic-sdp-uks | ||
Stream | Internent Engineering Task Force (IETF) | ||
Formats | plain text html xml pdf htmlized (tools) htmlized bibtex | ||
Reviews | |||
Stream | WG state | Submitted to IESG for Publication | |
Document shepherd | Bo Burman | ||
Shepherd write-up | Show (last changed 2019-06-05) | ||
IESG | IESG state | RFC 8844 (Proposed Standard) | |
Action Holders |
(None)
|
||
Consensus Boilerplate | Yes | ||
Telechat date | |||
Responsible AD | Adam Roach | ||
Send notices to | Bo Burman <bo.burman@ericsson.com> | ||
IANA | IANA review state | Version Changed - Review Needed | |
IANA action state | RFC-Ed-Ack |
Internet Engineering Task Force (IETF) M. Thomson Request for Comments: 8844 E. Rescorla Updates: 8122 Mozilla Category: Standards Track January 2021 ISSN: 2070-1721 Unknown Key-Share Attacks on Uses of TLS with the Session Description Protocol (SDP) Abstract This document describes unknown key-share attacks on the use of Datagram Transport Layer Security for the Secure Real-Time Transport Protocol (DTLS-SRTP). Similar attacks are described on the use of DTLS-SRTP with the identity bindings used in Web Real-Time Communications (WebRTC) and SIP identity. These attacks are difficult to mount, but they cause a victim to be misled about the identity of a communicating peer. This document defines mitigation techniques that implementations of RFC 8122 are encouraged to deploy. Status of This Memo This is an Internet Standards Track document. This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 7841. Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at https://www.rfc-editor.org/info/rfc8844. Copyright Notice Copyright (c) 2021 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Table of Contents 1. Introduction 2. Unknown Key-Share Attack 2.1. Limits on Attack Feasibility 2.2. Interactions with Key Continuity 2.3. Third-Party Call Control 3. Unknown Key-Share Attack with Identity Bindings 3.1. Example 3.2. The "external_id_hash" TLS Extension 3.2.1. Calculating "external_id_hash" for WebRTC Identity 3.2.2. Calculating external_id_hash for PASSporT 4. Unknown Key-Share Attack with Fingerprints 4.1. Example 4.2. Unique Session Identity Solution 4.3. The external_session_id TLS Extension 5. Session Concatenation 6. Security Considerations 7. IANA Considerations 8. References 8.1. Normative References 8.2. Informative References Acknowledgements Authors' Addresses 1. Introduction The use of Transport Layer Security (TLS) [TLS13] with the Session Description Protocol (SDP) [SDP] is defined in [FINGERPRINT]. Further use with Datagram Transport Layer Security (DTLS) [DTLS] and the Secure Real-time Transport Protocol (SRTP) [SRTP] is defined as DTLS-SRTP [DTLS-SRTP]. In these specifications, key agreement is performed using TLS or DTLS, with authentication being tied back to the session description (or SDP) through the use of certificate fingerprints. Communication peers check that a hash, or fingerprint, provided in the SDP matches the certificate that is used in the TLS or DTLS handshake. WebRTC identity (see Section 7 of [WEBRTC-SEC]) and SIP identity [SIP-ID] both provide a mechanism that binds an external identity to the certificate fingerprints from a session description. However, this binding is not integrity protected and is therefore vulnerable to an identity misbinding attack, also known as an unknown key-share (UKS) attack, where the attacker binds their identity to the fingerprint of another entity. A successful attack leads to the creation of sessions where peers are confused about the identity of the participants. This document describes a TLS extension that can be used in combination with these identity bindings to prevent this attack. A similar attack is possible with the use of certificate fingerprints alone. Though attacks in this setting are likely infeasible in existing deployments due to the narrow preconditions (see Section 2.1), this document also describes mitigations for this attack. The mechanisms defined in this document are intended to strengthen the protocol by preventing the use of unknown key-share attacks in combination with other protocol or implementation vulnerabilities. RFC 8122 [FINGERPRINT] is updated by this document to recommend theShow full document text