Re: [secdir] sec-dir review of draft-ietf-ipsecme-ikev2-fragmentation-06

[Valery Smyslov <[e-mail]>]

Hi,

>> Note, that in this proposal each IKE fragment is individually protected -
>> encrypted and authenticated. Forged fragments will be detected
>> before they are placed into reassembling queue and thus they
>> couldn't exhaust receiver's resources - only fragments from real peer
>> will be taken into consideration. And if attacker is capable enough
>> to drop an arbitrary IP packet, than there is no protection
>> anyway - the connection will fail on attacker's will in any case,
>> with or without IKE fragmentation.
>
> It's only authenticated in the sense that you have to have already had a
> full round trip so yes, an attacker can not forge their source IP.  But

No, it is fully cryptographically authenticated. IKE fragmentation
may only take place after shared keys (SK_*) keys are computed.

> that doesn't prevent a true DDoS where real hosts (think botnet) all
> perform a real IKE_SA_INIT and then use their sessions to build a lot of
> held state with "fake" fragments that will never complete.

Messages of IKE_SA_INIT cannot be fragmented with this proposal,
because SK_* are not yet computed. This is limitation, mentioned in the 
draft.
It is assumed that IKE_SA_INIT messages can
be made relatively small to avoid IP fragmentation.

> Like I said, it's an improvement because it's not at the kernel IP layer,
> and theoretically there are more resources available at the IKE layer.
> But it probably should still be mentioned.  (Not that IKE without
> fragmentation isn't also subject to this kind of DDoS attack).

As I've said, IKE_SA_INIT are beyond this proposal
(and IKE_SA_RESUME also, if we count in IKE session resumption
protocol). But messages of the other exchanges can be
fragmented with full cryptographic protection, including
authentication of each fragment, and I don't think this attack is possible
here (and it was one of the goals to prevent this kind of attack).

Regards,
Valery.

> Thanks,
>
>>
>> Regards,
>> Valery Smyslov.
>
> -derek
>
> -- 
>       Derek Atkins                 617-623-3745
>       [e-mail]             www.ihtfp.com
>       Computer and Internet Security Consultant
>