RE: weak authentication issue with rfc5083

[pgut001@xxxxxxxxxxxxxxxxx (Peter Gutmann)]

"Jim Schaad" <ietf@xxxxxxxxxxxxxxxxx> writes:

>I believe you have misunderstood the issue that Trevor raised.
>
>His problem is:
>
>1. I send you and him a single Authenticated Message.
>
>2. He takes the common CEK in the original message, uses it to create a MAC
>on an new message and then sends it on to you.
>
>As is always true with Authenticated messages, there is no proof of origin.
>He worries that you might be confused and believe the second messages was
>from me rather than from him.  Since they both use the same CEK that is not a
>factor that could be used to distinguish them.

Ah, OK, thanks.  How serious a threat is this in practice though?  Wouldn't
people just use asymmetric auth if they're worried about proof of origin?  I
realise it's kind of an interesting problem to solve, but does it need solving
beyond a security considerations note "If you're seriously worried about proof
of origin use a signature"?

Peter.