Re: [saag] can an on-path attacker drop traffic?

[Eric Rescorla <[e-mail]>]

On Sun, Oct 4, 2020 at 4:47 PM Eric Rescorla <[e-mail]> wrote:

>
>
> On Sun, Oct 4, 2020 at 3:17 PM Nico Williams <[e-mail]>
> wrote:
>
>> On Sat, Oct 03, 2020 at 07:58:15PM -0700, Eric Rescorla wrote:
>> > IMO the primary reason is that (!) there are some attacks which we do
>> not
>> > presently know how to defend against in the case of a Dolev-Yao
>> attacker,
>> > but which we can defend against a weaker attacker and (2) weaker
>> attackers
>> > exist.
>> >
>> > As a concrete example, it is possible for such an attacker to terminate
>> > even connections which are cryptographically protected (e.g., QUIC) by
>> > simply refusing to carry any packet, so in this respect, QUIC and TCP
>> are
>> > similar. However a weaker attacker (e.g., an off-path attacker) can
>> > terminate TCP connections by forging RSTs, which does not work against
>> QUIC
>> > because the connection termination signals are cryptographically
>> protected.
>> > I believe this is of some security value -- though perhaps you don't
>> agree,
>> > but we can only properly analyze it by considering a range of attacker
>> > capabilities.
>>
>> This is a DoS attack.  It is true that many DoS attacks cannot be
>> defeated cryptographically.  For example, a physical cable cut cannot be
>> protected against with crypto.  What kinds of active attacks other than
>> DoS attacks cannot be defended against?
>>
>
> I'm not sure that I would characterize connection termination as DoS
> (arguably, this is another case of terminological imprecision). For
> instance, sometimes it's a piece of another attack, such as in ABP+13 [0]
> or BDF+14 [1].
>
> In any case, another example of an attack that is difficult to defend
> against cryptographically is IP address spoofing attacks. For instance, an
> on-path attacker can force QUIC migration (how useful this is is not clear)
> but an off-path attacker cannot and an on-path attacker who cannot delete
> packets is supposed to be able to cause a hiccup but not permanent
> migration.
>
> Finally, another example of a limited threat model is one in which the
> attacker has Dolev-Yao access to only some set of network segments. This is
> often used in the analysis of anonymity protocols like Tor. While it is
> believed to be possible to build low latency protocols which provide
> anonymity under this threat model, AFAIK it is not known how to do so
> efficiently.
>

Correcting my bad writing here: "While it is believed to be possible to
build anonymity protocols under the stronger threat model, AFAIK it is not
known how to do so efficiently."

-Ekr

[0] http://www.isg.rhul.ac.uk/tls/RC4biases.pdf
[1] https://www.mitls.org/pages/attacks/3SHAKE

>