[IPsec] [IPSec] The NULL Authentication Method in IKEv2 Protocol - draft-ietf-ipsecme-ikev2-null-auth-07

[Dharmanandana Reddy Pothula <[e-mail]>]

Hi,



As per statement under section 2.4 in RFC 7296,



To prevent DoS attack on the initiator, "the initiator MAY be willing to accept multiple responses to its first message,
treat each response as potentially legitimate, respond to each one, and then discard all the invalid half-open connections when it
receives a valid cryptographically protected response to any one of its requests.  Once a cryptographically valid response is received,
all subsequent responses should be ignored whether or not they are cryptographically valid."



if we apply above scenario when initiator expects authentication null from responder, there is possibility that initiator will receive more than one cryptographically valid response,

as per above statement, the first one should be considered and subsequent responses should be ignored, but if first one is attacker and subsequent one is genuine peer, the connection establishes with the attacker.



We feel this is security risk. can you please provide more insight on this?



Regards,

Dharmanandana Reddy.P

Perumal. V