Re: [saag] can an on-path attacker drop traffic?

Dan Harkins <> Sun, 04 October 2020 17:22 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 023813A0906 for <>; Sun, 4 Oct 2020 10:22:44 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.112
X-Spam-Status: No, score=-2.112 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, NICE_REPLY_A=-0.213, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id RTqpUGi9cZre for <>; Sun, 4 Oct 2020 10:22:41 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id E4D703A0905 for <>; Sun, 4 Oct 2020 10:22:41 -0700 (PDT)
Received: from ( []) by (PMDF V6.8 #2433) with ESMTP id <> for; Sun, 04 Oct 2020 12:22:41 -0500 (CDT)
Received: from blockhead.local ([]) by (PMDF V6.7-x01 #2433) with ESMTPSA id <> for; Sun, 04 Oct 2020 10:20:11 -0700 (PDT)
Received: from ([] EXTERNAL) (EHLO blockhead.local) with TLS/SSL by ([]) (PreciseMail V3.3); Sun, 04 Oct 2020 10:20:11 -0700
Date: Sun, 04 Oct 2020 10:22:40 -0700
From: Dan Harkins <>
In-reply-to: <>
Message-id: <>
MIME-version: 1.0
Content-type: multipart/alternative; boundary="Boundary_(ID_1eV+rLVBdsAO/9OTW0J9Zw)"
Content-language: en-US
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:68.0) Gecko/20100101 Thunderbird/68.11.0
X-PMAS-SPF: SPF check skipped for authenticated session (, send-ip=
X-PMAS-External-Auth: [] (EHLO blockhead.local)
References: <> <>
X-PMAS-Software: PreciseMail V3.3 [201003] (
X-PMAS-Allowed: system rule (rule allow header:X-PMAS-External noexists)
Archived-At: <>
Subject: Re: [saag] can an on-path attacker drop traffic?
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Security Area Advisory Group <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Sun, 04 Oct 2020 17:22:44 -0000

On 10/3/20 10:23 PM, Christian Huitema wrote:
>> On Oct 3, 2020, at 8:00 PM, Eric Rescorla <> wrote:
>>     The QUIC "on-path" attacker seems to be a Dolev-Yao
>>     attacker.
>>     The "off-path" attacker seems to have the ability to
>>     observe
>>     packets, which I normally would not think an off-path attacker
>>     would have.
>>     So this definition is very surprising to me.
>> I agree it's not ideal. QUIC has been pubreq-ed, so you could raise 
>> it in IETF-LC.
> I think of it as man-in-the-middle, man-on-the-side and 
> man-in-the-rough. For me, the man in the middle is what EKR refers to 
> as the Dolev-Yao attacker; best hope there is to detect the attack and 
> reduce it to a denial of service.
> The man on the side is capable of reading the traffic and injecting 
> messages; it cannot easily delete messages,  but it can win races and 
> get his own fakery delivered before the genuine packets -- TCP RST is 
> an example of such attacks. Various national organizations have that 
> capability. It is much easier for them to implement than a full MITM. 
> I think that with effort we can defeat this class of attackers.
> The man in the rough does not see the traffic but can make guesses. 
> DDOS attacks, port scanning, observing or gaming DNS caches fall in 
> that category. Botnets sometimes resort to these attacks.

   This is useful. Defining it as classes of capabilities. The 
man-in-the-rough has
certain capabilities, class C. The man-on-the-side has those plus some 
others, class B.
And the man-in-the-middle (the Dolev-Yao attacker) has those plus some 
others, class
A. And A > B > C.

> And yes, in 2020 we probably need names that don't carry "man-in-foo" 
> imagery. But English is not my mother tongue...
   Yes, and sadly, this being 2020, identity politics plus bike shedding 
will mean most
of the time is spent on naming/imagery.