Re: [IPsec] Regarding ISAKMP SA lifetime negotiation.

[Tero Kivinen <[e-mail]>]

Anoop V A (anova) writes:
>  If we are sending the extra IKE responder life time notification in
>  MM6 or AM2 - since the peer AUTHENTICATION data is also available
>  in these messages - can we overcome this situation. We can avoid
>  attack by changing the life time only if the authentication is
>  successful.

As I pointed out earlier, attacker can MODIFY the notification data,
so they can change the life time stored inside the notification data
(there are some difficulties there, but lets not go to them). On the
other hand you would never accept any lifetime that would not be
accordingly to your own policy anyways, so this attack isn't that
effective in this case, as attacker can only change lifetime to
something that you would otherwise accept. So in worst case you are in
the same situation you were without this notification.

> I understand may be other implementation will avoid this extra
> notify - but is there any violation in sending this extra notify in
> these messages? 

Most likely they will ignore the extra notify, but to be safe it might
be better to add vendor id payloads and only send notify if the other
end is sending known vendor id. There are some quite bad IKEv1
implementations out there, and I would not even try to guess what they
might do when they get extra notification payloads.
-- 
[e-mail]