Re: [dhcwg] WGLC on draft-ietf-dhc-sedhcpv6-21 - Respond by March 29th

[Sten Carlsen <[e-mail]>]

Sorry for late comment but this just caught my attention.

>>     BV> Re Security Considerations - A new comment from a
>>     conversation with Tomek (Tomek will hopefully comment more). I
>>     mentioned that I was concerned with the possibility of clients
>>     and servers getting “junk” is a security concern as someone could
>>     generate bad packets with encrypted data and send them to clients
>>     and servers in the hope to crash the either when they try to
>>     decrypt and then process junk. Tomek suggested we might want to
>>     think about whether to add some magic value to the first few
>>     bytes of a message before encrypting it and then the decrypter
>>     can check those first few bytes to see if they are value and
>>     discard the message if not. Perhaps the encoding from RFC5652
>>     would accomplish this if we are using more than just the
>>     encryptedContent? Anyway, something to think about.
>>
>> [LS]: Agree. Perhaps the encoding from RFC5652 solves this problem. 
>> I think that it may be a general problem for all encryption protocol. 
If someone deliberately wants to make bad packets with the purpose of
causing problems, they would be smart enough to add the same magic
number? Knowing the encryption algorithms would allow more deliberate
attempts to cause overflow etc.

I don't see any other method than careful programming and careful
testing with deliberate intent to find weak spots.

If we talk about noise or other non-intentional bad/random packet, then
a magic number will help.

-- 
Best regards

Sten Carlsen

No improvements come from shouting:

       "MALE BOVINE MANURE!!!"