Re: [secdir] Review of draft-ietf-ipsecme-esp-null-heuristics-06.txt

[Dan McDonald <[e-mail]>]

On Wed, Mar 03, 2010 at 01:45:54PM +0200, Tero Kivinen wrote:
> > - The discussion of failure modes for the heuristics is in section 3,
> >   with no reference from the Security Considerations section.
> 
> Do you have any concrete proposal what text to add to security
> considerations section?

Tero -- I will add some of your text below to both Section 3 and the Security
Considerations.

> > - The discussion of failure modes for the heuristics in section 3 is
> >   also incomplete: while it (correctly, I think) concludes that
> >   misclassifying traffic as ESP-NULL is no worse than a DoS attack
> >   which an attacker could have launched anyway, it does not discuss
> >   the other failure mode: what happens if a stream is misclassified as
> >   non-NULL ESP, thus (depending on policy) allowing it through without
> >   inspection, or dropping it on the floor?
> 
> It does say that valid ESP-NULL stream cannot be misclassified as
> non-ESP-NULL stream. The only way for valid ESP-NULL stream to be
> classified as non-ESP-NULL is that the packet does not look valid
> ESP-NULL packet (i.e. for example has garbage in the ESP padding), but
> then it is not valid ESP-NULL packet anymore.

Actually, it's possible that using an authentication algorithm of which the
inspector is not aware can cause ESP-NULL to be misclassified.  Other than
that, we catch everything else.

> I.e. valid EPS-NULL packets cannot be misclassified, but of course
> attacker can easily send packets which cause those packets to be
> misclassified as encrypted ESP, but on the other hand attacker can
> most likely also use encrypted ESP instead (as is listed in the
> security considerations section) if encrypted ESP packets are to be
> allowed to that host.

Rob -- are you also worried about flow-poisoning?  If an attacker manages (by
chance?) to trick an inspecting node into considering a flow encrypted, and
then the inspecting node *caches* that flow as poison (a bad implementation
choice, to be sure, but possible given how much crap is out there), then
legitimate ESP-NULL packets could be dropped.

> All of those depends very much about what kind of the policy is used
> in the intermediate devices. If the policy says drop all packets which
> cannot be inspected, then attacker does not gain anything by getting
> flow misclassified.

The attacker gains denial-of-service, which may be all he/she wants.

Dan