IETF Logo Mail Archive

Re: Pseudorandom Flow Labels

John Leslie <john@jlc.net> Thu, 07 April 2011 12:08 UTC

Return-Path: <john@jlc.net>
X-Original-To: ipv6@core3.amsl.com
Delivered-To: ipv6@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 753573A6A03 for <ipv6@core3.amsl.com>; Thu, 7 Apr 2011 05:08:41 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -106.55
X-Spam-Level:
X-Spam-Status: No, score=-106.55 tagged_above=-999 required=5 tests=[AWL=0.049, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0Bp6owcroGxR for <ipv6@core3.amsl.com>; Thu, 7 Apr 2011 05:08:40 -0700 (PDT)
Received: from mailhost.jlc.net (mailhost.jlc.net [199.201.159.4]) by core3.amsl.com (Postfix) with ESMTP id C9EE93A68AC for <ipv6@ietf.org>; Thu, 7 Apr 2011 05:08:40 -0700 (PDT)
Received: by mailhost.jlc.net (Postfix, from userid 104) id 494F833C24; Thu, 7 Apr 2011 08:10:25 -0400 (EDT)
Date: Thu, 07 Apr 2011 08:10:25 -0400
From: John Leslie <john@jlc.net>
To: Fernando Gont <fernando@gont.com.ar>
Subject: Re: Pseudorandom Flow Labels
Message-ID: <20110407121025.GH24474@verdi>
References: <BD901061-96AC-4915-B7CE-2BC1F70861A5@castlepoint.net> <201104052036.p35KaoHV019253@cichlid.raleigh.ibm.com> <4D9CAF52.9050805@gont.com.ar> <20110406204424.GG24474@verdi> <4D9CD97D.1060208@gont.com.ar>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <4D9CD97D.1060208@gont.com.ar>
User-Agent: Mutt/1.4.1i
Cc: 6man List <ipv6@ietf.org>
X-BeenThere: ipv6@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: "IPv6 Maintenance Working Group \(6man\)" <ipv6.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/ipv6>, <mailto:ipv6-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/ipv6>
List-Post: <mailto:ipv6@ietf.org>
List-Help: <mailto:ipv6-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ipv6>, <mailto:ipv6-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 07 Apr 2011 12:08:41 -0000

Fernando Gont <fernando@gont.com.ar> wrote:
> On 06/04/2011 05:44 p.m., John Leslie wrote:
>> Fernando Gont <fernando@gont.com.ar> wrote:
>>> * We want Flow Labels that unpredictable by off-path attackers (history
>>>   has taught us that this is a good proactive measure)
>> 
>> I'm afraid I don't follow: what sort of attack could an off-path
>> attacker mount by correctly guessing the Flow Label?
> 
> Play with ECMP/LAG.

   I'm afraid you'll need to be more specific: I still don't see an
attack against the sender here.

> And, it's clear you could never implement something like
> draft-blake-ipv6-flow-label-nonce-02 if FLs are predictable.

   I did think of that, but decided I'd never want to use such a thing.
There are quite a few better ways to accomplish the goal, and far too
many opportunities for middleboxes to screw it up.

--
John Leslie <john@jlc.net>

v2.23.0 | Report a Bug | By Email