Re: [babel] Minor clarification to HMAC

[Juliusz Chroboczek <[e-mail]>]

> To me this sounds much like a SYN flood attack in TCP, where TCP resources were
> allocated before the ACK came back. And TCP had to come back to clarify this,
> rather than leave it as a implementation level detail.

RFC 4987.  The issues are similar, the same defenses apply, but there is
one significant difference.

The very first thing that happens is that the HMAC is verified.  No state
is created if the HMAC fails (Section 4.3, first bullet).  What is more,
the HMAC includes a pseudo-header (Section 4.1), so a packet can only be
replayed by spoofing the source address it was originally sent from.

Since neighbour entries are indexed by source address, the amount of state
an attacker can create is limited by the number of different source
addresses in his collection of previously captured packets.  What is more,
everytime the network undergoes key rotation, all of the captured packets
are invalidated.

So an easy defense is to roll over the keys often enough so that the
attacker can only create a bounded amount of state.

> If we agree that a MAY should be allowed, I would like to see some guidance
> given on some implementation choices including the fact that a separate table
> of pending challenges should be kept to prevent an attack. 

Please check the last two paragraphs of Section 6 (Security Considerations),
and let me know if you think I should add something there.

-- Juliusz