Re: [saag] can an on-path attacker drop traffic?

[Christian Huitema <[e-mail]>]

> On Oct 3, 2020, at 8:00 PM, Eric Rescorla <[e-mail]> wrote:
> 
>> The QUIC 21.13.3.1 "on-path" attacker seems to be a Dolev-Yao attacker.
>> 
>> The 21.13.3.2 "off-path" attacker seems to have the ability to observe
>> packets, which I normally would not think an off-path attacker would have.
>> So this definition is very surprising to me.
> 
> I agree it's not ideal. QUIC has been pubreq-ed, so you could raise it in IETF-LC.

I think of it as man-in-the-middle, man-on-the-side and man-in-the-rough. For me, the man in the middle is what EKR refers to as the Dolev-Yao attacker; best hope there is to detect the attack and reduce it to a denial of service.

The man on the side is capable of reading the traffic and injecting messages; it cannot easily delete messages,  but it can win races and get his own fakery delivered before the genuine packets -- TCP RST is an example of such attacks. Various national organizations have that capability. It is much easier for them to implement than a full MITM. I think that with effort we can defeat this class of attackers.

The man in the rough does not see the traffic but can make guesses. DDOS attacks, port scanning, observing or gaming DNS caches fall in that category. Botnets sometimes resort to these attacks.

And yes, in 2020 we probably need names that don't carry "man-in-foo" imagery. But English is not my mother tongue...

-- Christian Huitema