Clarifications below... Eugen Leitl wrote:

----- Forwarded message from "\"Hal Finney\"" -----

From: hal@finney.org ("Hal Finney") Date: Thu, 9 Sep 2004 12:57:29 -0700 (PDT) To: cryptography@metzdowd.com, cypherpunks@al-qaeda.net, rah@shipwright.com Subject: Re: potential new IETF WG on anonymous IPSec

...

The IETF has been discussing setting up a working group for anonymous IPSec. They will have a BOF at the next IETF in DC in November. They're also setting up a mailing list you might be interested in if you haven't heard about it already. ... http://www.postel.org/anonsec

To clarify, this is not really "anonymous" in the usual sense.

It does not authenticate the endpoint's identification, other than "same place I had been talking to." There's no difference between having no "name" and having a name you cannot trust. I.e., I could travel under the name "anonymous" or "", or under the name "A. Smith". If you don't know whether I am actually A. Smith, the latter is identical to the former.

Rather it is a proposal to an extension to IPsec to allow for unauthenticated connections.

Correction: it is a proposal to extend Internet security - including Ipsec, but also including TCP-MD5 (sometimes called "BGP MD5") and other security mechanisms at various layers. It is not focused only on IPsec.

Presently IPsec relies on either pre-shared secrets or a trusted third party CA to authenticate the connection. The new proposal would let connections go forward using a straight Diffie-Hellman type exchange without authentication.

This is one option, but not the only one.

It also proposes less authentication of IP message packets, covering smaller subsets, as an option.

There are two aspects: - smaller portion of the packet is hashed - none of the packet is hashed, but a cookie is used

The point has nothing to do with anonymity;

The last one, agreed. But the primary assumption is that we can avoid a lot of infrastructure and impediment to deployment by treating an ongoing conversation as a reason to trust an endpoint, rather than a third-party identification. Although anonymous access is not the primary goal, it is a feature of the solution.

rather it is an attempt to secure against weaknesses in TCP which have begun to be exploited.

Please review the draft; there are a number of reasons this is being considered, not the least of which is to reduce the cumbersome requirement of key infrastructure as well as to avoid performance penalties.

Sequence number guessing attacks are more successful today because of increasing bandwidth, and there have been several instances where they have caused disruption on the net. While workarounds are in place, a better solution is desirable.

Please be more specific; how would it be better?

This new effort is Joe Touch's proposal to weaken IPsec so that it uses less resources and is easier to deploy. He calls the weaker version AnonSec. But it is not anonymous, all the parties know the addresses of their counterparts.

Address != identity. Agreed, if what you want to do is hide traffic, this does not provide traffic confidentiality. But it does not tell you whether the packets come from 128.9.x.x (ISI, e.g.) or from someone spoofing 128.9.x.x; all you know is that whoever is using that address is capable of having an ongoing conversation (TCP connection, e.g.) with you. I.e., there are two ways to be anonymous, as noted earlier: 1) don't give out your name (A. Smith, e.g.) 2) give out a name, but it doesn't necessarily mean anything (e.g., Mickey Mouse) Even if you use "real" names in (2), there's no difference with (1), since you don't know whether the real Mickey Mouse is using it.

Rather, it allows for a degree of security on connections between communicators who don't share any secrets or CAs. I don't think "anonymous" is the right word for this, and I hope the IETF comes up with a better one as they go forward.

Hal Finney

--------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo@metzdowd.com

----- End forwarded message -----

------------------------------------------------------------------------

_______________________________________________

_______________________________________________ ---------- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net --- end forwarded text -- ----------------- R. A. Hettinga The Internet Bearer Underwriting Corporation http://www.ibuc.com/ 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'