Re: [IPsec] IKE fragmentation

"Valery Smyslov" <> Thu, 14 March 2013 15:08 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 925EB11E8271 for <>; Thu, 14 Mar 2013 08:08:57 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: 2.57
X-Spam-Level: **
X-Spam-Status: No, score=2.57 tagged_above=-999 required=5 tests=[AWL=0.867, BAYES_00=-2.599, DOS_OE_TO_MX=2.75, FH_RELAY_NODNS=1.451, RDNS_NONE=0.1, STOX_REPLY_TYPE=0.001]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id blFqtj+2CcrM for <>; Thu, 14 Mar 2013 08:08:56 -0700 (PDT)
Received: from ( [IPv6:2a00:1450:4010:c03::231]) by (Postfix) with ESMTP id DE58111E8262 for <>; Thu, 14 Mar 2013 08:08:37 -0700 (PDT)
Received: by with SMTP id fs13so2545612lab.8 for <>; Thu, 14 Mar 2013 08:08:34 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20120113; h=x-received:message-id:from:to:cc:references:subject:date :mime-version:content-type:content-transfer-encoding:x-priority :x-msmail-priority:x-mailer:x-mimeole; bh=nDC1R7Zl+3Sa0gSSSyoWvDPr7nX/byQDzjC1UdMFnXg=; b=e3D88hoKnF57vzy4H3FvtuyTirTPPOLjYs30DHS6GkOoRaxReWWau8AXndwJGyQw6V +rtVvytCQTm+dTkfhOi2z2t8r3fVg9vemz1ytoum77g7gElIezbk9jsa4MG72FZi4VI6 II4Ynvay4wOtz3KYi5Voidoq8b5wvZaZQqsBOd66cc6BN06BlcpWc0mruUovSogTXPnC dC9QHurSNhmk/qQICyu2zAE9W6cqKv84mCphLaDTbdIdJ9PURjjHroGbA62+ruBiAMLl pOg+MzeusntrvfNr8OGIULUMVeJZff/ST1ZiozI0Scss6PFOxVeXiZwpgs35QWBXWU+2 l9hg==
X-Received: by with SMTP id gi17mr2457252lab.46.1363273714272; Thu, 14 Mar 2013 08:08:34 -0700 (PDT)
Received: from buildpc ([]) by with ESMTPS id c10sm928089lbu.11.2013. (version=TLSv1 cipher=RC4-SHA bits=128/128); Thu, 14 Mar 2013 08:08:33 -0700 (PDT)
Message-ID: <37EA3A0F84914E7FAB43CF50ABA9F780@buildpc>
From: Valery Smyslov <>
To: Yoav Nir <>, Tero Kivinen <>
References: <> <294A12724CB849D2A33F7F80CC82426A@buildpc> <> <3028CF35E60A40068CE70EB7BB0BDEF1@buildpc> <> <FCC464E01434424EB7EB4365E86F9130@buildpc> <> <> <>
Date: Thu, 14 Mar 2013 19:08:47 +0400
MIME-Version: 1.0
Content-Type: text/plain; format="flowed"; charset="iso-8859-1"; reply-type="original"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.5931
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.6157
Subject: Re: [IPsec] IKE fragmentation
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Discussion of IPsec protocols <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Thu, 14 Mar 2013 15:08:58 -0000

> >> What your draft does, is force the initiator to protect each
> >> fragment. To protect a fragment in a way that will cause the
> >> responder to store it, requires running the MAC function, and that
> >> in turn requires generating the keys (running the PRF), which in
> >> turn requires completing the D-H calculation. If the initiator fails
> >> to do any of these things, the fragment will be immediately rejected
> >> at the responder. Of course, the D-H calculation is not
> >> per-fragment, and I did not claim that this was the case.
> >
> > Initiator must do Diffie-Hellman anyways before it can send IKE_AUTH.
> True for a legitimate Initiator. At attacker can send fake fragments, and 
> the responder has the option of expanding
> CPU resources for verifying the ICV, or expanding the memory resources for 
> storing them for a while.

There is no difference comparing with usual, non-fragmented IKE_AUTH 
message -
responder still can be forced by attacker to complete DH, calculate keys and
try to verify forged message. And fragmentation doesn't make it worse.

And even with unprotected fragments it is not a big deal for attacker to 
you a set of fragments that you will successfully reassemble to a 
message and then you again will have to complete DH, calculate keys and
try to verify that garbage. No difference.