DDS-SECURITY 1.1 RTF Avatar
  1. OMG Issue

DDSSEC11 — Non-Recoverable Communication After Authentication Session Terminated

  • Key: DDSSEC11-81
  • Status: closed  
  • Source: THALES ( Cyril Dangerville)
  • Summary:

    After two participants are mutually authenticated and authorized, each participant's session with the remote participant (certificate, shared secret, challenge1, challenge2...) may be terminated/removed at a certain time for various reasons such as:

    • Automatic termination: sessions should have a max lifetime to follow best security practices, to handle the fact that the remote participant's certificate may expire, be revoked, etc. and therefore no longer trusted (worst case scenario: the issuing CA (or any ancestor) cert expires/is revoked).
    • Administrative termination: some administrator decides to force the session termination because of a security alert or for debugging purposes.

    If the session is terminated on one side but not on the other, we end up in the same deadlock situation as in DDSSEC11-43 (scenario 1 and 2) except the root cause is not liveliness loss but simple automatic/administrative session termination.

  • Reported: DDS-SECURITY 1.0 — Sat, 20 May 2017 16:26 GMT
  • Disposition: Duplicate or Merged — DDS-SECURITY 1.1
  • Disposition Summary:

    Close as duplicate of DDSSEC11-43

    This will be handled with DDSSEC11-43

  • Updated: Tue, 19 Dec 2017 20:03 GMT