Re: How does a server identify a new connection?

[Kazuho Oku <[e-mail]>]

2018年12月1日(土) 1:44 Dmitri Tikhonov <[e-mail]>:
>
> On Fri, Nov 30, 2018 at 08:08:14AM -0800, Christian Huitema wrote:
> > > On Nov 30, 2018, at 7:37 AM, Dmitri Tikhonov <[e-mail]> wrote:
> > > Is such attack feasible?  By definition, the man-on-the-side cannot
> > > delay the original packet.  For the spoofed packet to reach the
> > > server first, the man-on-the-side would have to have access to a
> > > different, faster path to that server.
> >
> > Non only feasible, but in actual use now. Do for example a search
> > for "Quantum Insert".
>
> The fundamental difference between the attack described in this thread
> and Quantum Insert [1] is that in our (the former) case, the attacker
> must spoof the very first Initial packet.  This makes it less likely
> (I am guessing a lot less likely) for the spoofed packet to win the race
> with the original.  I remain unconvinced (pleading ignorance again) that
> such attack is feasible.
>
> > > I am asking these questions a) out of ignorance and b) as the
> > > implications of the proposed change (PR 2076) begin to dawn on me.
> >
> > Defending against inserts after the handshake is relatively easy
> > and everybody should do it. Defending the initial handshake involves
> > speculative initiation of many connection copies, and then rolling
> > back the bad ones once a good one was verified. So, yes, it is costly.
>
> This realization is what prompted my email.

How high the "cost" is depends on who you are.

If you are running a client that is struggling to create a connection,
I do not think testing 10 ServerHellos you receive to identify which
one was correct is something you can pay for. It's essentially an
automatic and safer way of hitting the reload button.

OTOH, the cost is a big issue for the server, because it needs to pay
the cost for every connection attempt it accepts.

Therefore, a strategy that puts the most cost of detecting an
mitigating man-on-the-side attacks on the client-side is a good
approach.

The minimum requirement we need to have for the server is: 1) call
different ClientHellos as different connections 2) ignore (or delay
the application of) other information carried in Initial packet that
has fatal effect on connection establishment.

I can understand that some might not want to implement such behavior.
However, I think it is beneficial to document how you could build a
man-on-the-side attack resistance server, because that would help
people actually implement such servers.

Then, we can give clients that actually see the problem the chance to
implement the costly countermeasure.

>
>   - Dmitri.
>
> 1. https://blog.fox-it.com/2015/04/20/deep-dive-into-quantum-insert/



-- 
Kazuho Oku