[secdir] Review of draft-ietf-ipsecme-esp-null-heuristics-06.txt

[Tero Kivinen <[e-mail]>]

Rob Austein writes:
> The Security Considerations section is OK as far as it goes, but could
> benefit from some additional text or references to other parts of the
> document.  Specifically:
> 
> - The discussion of failure modes for the heuristics is in section 3,
>   with no reference from the Security Considerations section.

Do you have any concrete proposal what text to add to security
considerations section?

> - The discussion of failure modes for the heuristics in section 3 is
>   also incomplete: while it (correctly, I think) concludes that
>   misclassifying traffic as ESP-NULL is no worse than a DoS attack
>   which an attacker could have launched anyway, it does not discuss
>   the other failure mode: what happens if a stream is misclassified as
>   non-NULL ESP, thus (depending on policy) allowing it through without
>   inspection, or dropping it on the floor?

It does say that valid ESP-NULL stream cannot be misclassified as
non-ESP-NULL stream. The only way for valid ESP-NULL stream to be
classified as non-ESP-NULL is that the packet does not look valid
ESP-NULL packet (i.e. for example has garbage in the ESP padding), but
then it is not valid ESP-NULL packet anymore.

I.e. valid EPS-NULL packets cannot be misclassified, but of course
attacker can easily send packets which cause those packets to be
misclassified as encrypted ESP, but on the other hand attacker can
most likely also use encrypted ESP instead (as is listed in the
security considerations section) if encrypted ESP packets are to be
allowed to that host.

All of those depends very much about what kind of the policy is used
in the intermediate devices. If the policy says drop all packets which
cannot be inspected, then attacker does not gain anything by getting
flow misclassified. If policy is allow those through, then attacker
can use encrypted ESP to bypass the deep inspection device anyways,
which means the other end should have its own ways of inspecting the
packets anyways, as middle box cannot inspect them.
-- 
[e-mail]