resistance to swamping attacks.

[Bill Sommerfeld <[e-mail]>]

at the last IETF meeting, there was a presentation about how cookies
don't necessarily help all that much.

There have been a number of press reports about swamping attacks on
TCP using forged source addresses.  Some of these press reports have
suggested that IPv6 will solve all this by requiring authentication.

I'd like this to be the truth, not just optimism..

I think that one of the not-well-stated requirements of ipsec is that
it resist such attacks -- most importantly, that a system be able to
continue to communicate with legitimate peers in the face of a
packet-storm, including peers it did not have any shared state with
prior to the start of the storm.

Here's a more specific goal:

If a system has a normal communications bandwidth of X, and recieves
an incoming storm from forged source addresses with a bandwidth of Y
(less than X), it should be able to continue to use at least half of
the remaining bandwith (X-Y) constructively to communicate with
arbitrary legitimate peers, including peers which had never before
communicated with it.

Now, at some level, this is a property of the implementation, but
nothing in the *protocol* should preclude this.

Any objections?

					- Bill