Re: [saag] can an on-path attacker drop traffic?

[Eric Rescorla <[e-mail]>]

On Sun, Oct 4, 2020 at 3:17 PM Nico Williams <[e-mail]> wrote:

> On Sat, Oct 03, 2020 at 07:58:15PM -0700, Eric Rescorla wrote:
> > IMO the primary reason is that (!) there are some attacks which we do not
> > presently know how to defend against in the case of a Dolev-Yao attacker,
> > but which we can defend against a weaker attacker and (2) weaker
> attackers
> > exist.
> >
> > As a concrete example, it is possible for such an attacker to terminate
> > even connections which are cryptographically protected (e.g., QUIC) by
> > simply refusing to carry any packet, so in this respect, QUIC and TCP are
> > similar. However a weaker attacker (e.g., an off-path attacker) can
> > terminate TCP connections by forging RSTs, which does not work against
> QUIC
> > because the connection termination signals are cryptographically
> protected.
> > I believe this is of some security value -- though perhaps you don't
> agree,
> > but we can only properly analyze it by considering a range of attacker
> > capabilities.
>
> This is a DoS attack.  It is true that many DoS attacks cannot be
> defeated cryptographically.  For example, a physical cable cut cannot be
> protected against with crypto.  What kinds of active attacks other than
> DoS attacks cannot be defended against?
>

I'm not sure that I would characterize connection termination as DoS
(arguably, this is another case of terminological imprecision). For
instance, sometimes it's a piece of another attack, such as in ABP+13 [0]
or BDF+14 [1].

In any case, another example of an attack that is difficult to defend
against cryptographically is IP address spoofing attacks. For instance, an
on-path attacker can force QUIC migration (how useful this is is not clear)
but an off-path attacker cannot and an on-path attacker who cannot delete
packets is supposed to be able to cause a hiccup but not permanent
migration.

Finally, another example of a limited threat model is one in which the
attacker has Dolev-Yao access to only some set of network segments. This is
often used in the analysis of anonymity protocols like Tor. While it is
believed to be possible to build low latency protocols which provide
anonymity under this threat model, AFAIK it is not known how to do so
efficiently.

-Ekr

[0] http://www.isg.rhul.ac.uk/tls/RC4biases.pdf
[1] https://www.mitls.org/pages/attacks/3SHAKE