The Inter-Domain Key Exchange Protocol A Cryptographic Protocol for Fast, Secure Session-Key Establishment and Re-Authentication of Mobile Nodes after Inter-Domain Handovers Dissertation zur Erlangung des Doktorgrades der Mathematisch - Naturwissenschaftlichen Fakultäten der Georg-August-Universität zu Göttingen vorgelegt von Rene Alexander Soltwisch aus Lübeck Göttingen 2006 D7 Referent: Prof. Dr. Dieter Hogrefe Korreferent: Prof. Dr. Bernhard Neumair Tag der mündlichen Prüfung: 18. Januar 2006 ii Abstract This thesis introduces, specifies and evaluates a novel key establishment mechanism to enable seamless authenticated handovers in IP networks called Inter‐Domain Key Exchange Protocol (IDKE). The task of the IDKE protocol is to quickly re‐establish trust and a shared session‐key between the mobile node and the access network. This is implemented after a mobile node’s handover by forwarding the session‐key from the previous to the new access network. IDKE’s major strength is in providing a secured key forwarding even when the two domains initially do not trust each other. The purpose of the transferred key is to secure the access link, thus providing confidentiality, integrity and access control. Generally such keys are obtained from the mobile node’s home network, whereas the IDKE protocol forwards the key locally in between access networks via an exclusively established and secured communication channel. This work specifies security properties for authentication and secrecy and verifies the IDKE protocol by model checking. The protocol is modeled by Communication Sequential Processes (CSP); formal security verification is performed by Failure Divergence Refinement (FDR). Furthermore, the function for handling concurrent protocol runs is added to the IDKE protocol. The extended specification is simulated and verified by utilizing the Specification and Description Language (SDL) in order to analyze the robustness and the scalability of the protocol. Finally, the performance is compared to other approaches such as the Global System for Mobile Communications (GSM) and the Wireless Shared Key Exchange Protocol (W‐SKE) using the discrete event simulator OPNET Modeler. iii iv Acknowledgments I would like to express my sincere gratitude to my supervisor Prof. Dr. Hogrefe for his assistance and the possibility to research under such perfect conditions. The work at the Institute for Informatics at the Georg August University of Göttingen has been a very positive experience. I much appreciate the fact that I was allowed to act independently in a trustful atmosphere. My thanks go out to my colleagues from the Institute of Informatics at the University of Göttingen who have accompanied me throughout the years. A special thank you to Michael Ebner, Xiaoming Fu and Constantin Werner for the useful discussions on security, mobility and other thesis related topics. I also wish to thank the students Florian Tegeler, Niklas Steinleitner and Dirk Lessner who wrote Bachelor theses, participated in master courses and who wrote papers with me on subjects that strongly related to this thesis. Furthermore, I am most grateful to all the students who participated in my Network Security seminars and who contributed many useful summaries on a wide range of security related topics. This thesis would not be in its current form without the numerous proof‐readers who have spent their spare time correcting typing errors, dealing with missing indexes, etc. and who have given helpful hints on how to improve my thesis. I thank Michael O’Connell, Edith Werner and Anja Wollrath for their efforts. I am also greatly indebted to my parents for “introducing” me to this world and who together with my grandparents encouraged me to study computer science, without which this thesis would never have seen the light of day. v vi The IDKE Protocol Table of Contents Table of Contents ABSTRACT ............................................................................................................................................................III ACKNOWLEDGMENTS.............................................................................................................................................V TABLE OF CONTENTS ...........................................................................................................................................VII LIST OF FIGURES ...................................................................................................................................................XI CHAPTER 1 INTRODUCTION...................................................................................................................................1 1.1 PROBLEM STATEMENT................................................................................................................................. 1 1.2 RELATED WORK......................................................................................................................................... 2 1.3 SOLUTION DESCRIPTION............................................................................................................................... 3 1.4 THE STRUCTURE OF THE THESIS..................................................................................................................... 4 CHAPTER 2 FUNDAMENTALS & RELATED WORK .....................................................................................................7 2.1 THE MOBILE INTERNET ................................................................................................................................ 7 2.1.1 Quality of Service and Resource Management................................................................................. 8 2.1.2 The Handover Reference Scenario ................................................................................................... 9 2.2 MOBILE IP ............................................................................................................................................. 11 2.2.1 Mobile IP Overview ........................................................................................................................ 12 2.2.2 Mobile IP Extensions & Optimizations............................................................................................. 13 2.3 CRYPTOGRAPHY AND SECURITY ................................................................................................................... 16 2.3.1 Security Services & Properties........................................................................................................ 17 2.3.2 Symmetric Cryptography............................................................................................................... 18 2.3.3 Asymmetric Cryptography............................................................................................................. 20 2.3.4 Symmetric vs. Asymmetric Cryptography...................................................................................... 21 2.3.5 Public Key Infrastructure................................................................................................................ 22 2.3.6 Hash Functions, MACs and One Way Functions.............................................................................. 23 2.4 CRYPTOGRAPHIC PROTOCOLS...................................................................................................................... 23 2.4.1 Authentication and Session-Key Establishment.............................................................................. 25 2.4.2 Authentication Protocol Approaches.............................................................................................. 30 2.4.3 Protocol Vulnerabilities................................................................................................................... 32 2.5 PROTOCOLS FOR INTERNET SECURITY ............................................................................................................ 36 2.5.1 Oakley and ISAKMP ........................................................................................................................ 36 2.5.2 Internet Security Protocol (IPsec).................................................................................................... 37 2.5.3 Key Distribution in IPsec................................................................................................................. 44 CHAPTER 3 THE INTER-DOMAIN KEY EXCHANGE PROTOCOL APPROACH...............................................................45 3.1 OVERVIEW.............................................................................................................................................. 45 3.1.1 Objectives ...................................................................................................................................... 46 3.1.2 Protocol Framework....................................................................................................................... 48 vii The IDKE Protocol Table of Contents 3.1.3 Preconditions and Postconditions .................................................................................................. 50 3.2 PROTOCOL SPECIFICATION.......................................................................................................................... 51 3.2.1 Authentication Properties............................................................................................................... 56 3.2.2 Home Authentication & Initial Key Setup.......................................................................................