Re: [Spud] [Privsec-program] Detecting and Defeating TCP/IP Hypercookie Attacks

Eliot Lear <> Mon, 01 August 2016 15:09 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 9A15F12DA16 for <>; Mon, 1 Aug 2016 08:09:01 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -15.809
X-Spam-Status: No, score=-15.809 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-1.287, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (1024-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id xlNpCyxYsGnD for <>; Mon, 1 Aug 2016 08:09:00 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id D574512DC41 for <>; Mon, 1 Aug 2016 08:08:59 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple;;; l=4539; q=dns/txt; s=iport; t=1470064139; x=1471273739; h=subject:to:references:cc:from:message-id:date: mime-version:in-reply-to; bh=FZn5rD/VwL1NZj7HoZcSLsZntW/sGbZaRdLJLzf2P9g=; b=EIc+KWZOFj2MEjnVCQgKVvE84CwlntN8ud0/ycInfCBo32adkALTNDaR oRazEa/miijVfCHIBvYY442d15D72kRevarXzBCmJ42wZt8uPptnejQYe Zk+Z+JsEp3HzNJurKZasWdsJEPGsMApaDPAVAaS8qkCMIT5ijNROXA5w6 8=;
X-Files: signature.asc : 481
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0CoBADkZJ9X/xbLJq1dhEW7YoYdAoFoE?= =?us-ascii?q?QEBAQEBAQFdJ4RfAQUjVhALGCoCAlcGDQgBAYgtsGyPaAEBAQEBAQEBAQEBAQE?= =?us-ascii?q?BAQEBEg6IIoJVh0GCWgEEmTODOoFwiVWJU4VskCc0IIN8OohHAQEB?=
X-IronPort-AV: E=Sophos;i="5.28,455,1464652800"; d="asc'?scan'208";a="680415254"
Received: from (HELO ([]) by with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 01 Aug 2016 15:08:57 +0000
Received: from [] ([]) by (8.14.5/8.14.5) with ESMTP id u71F8vWt008352; Mon, 1 Aug 2016 15:08:57 GMT
To: Tom Herbert <>
References: <> <> <> <> <> <> <> <> <> <> <> <> <> <>
From: Eliot Lear <>
Message-ID: <>
Date: Mon, 1 Aug 2016 17:08:57 +0200
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.2.0
MIME-Version: 1.0
In-Reply-To: <>
Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="wJ9fXFAS74nTNFbakANxabDwaCNrPGcQH"
Archived-At: <>
Cc: Stephan Neuhaus <>, Stephen Farrell <>, =?UTF-8?Q?Mirja_K=c3=bchlewind?= <>, spud <>, Brian Trammell <>
Subject: Re: [Spud] [Privsec-program] Detecting and Defeating TCP/IP Hypercookie Attacks
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Session Protocol Underneath Datagrams <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 01 Aug 2016 15:09:01 -0000

Hey Tom,

On 8/1/16 4:59 PM, Tom Herbert wrote:
> If that [99.999%] number it is correct it is only because home routers have
> ossified the Internet in that regard

I realize that people have ossification on the head, but I'm sure you
recognize that the right answer here is that most people only have a
single connection into their homes.  For those who have more than one,
the two either are disconnected networks or they come together in the
same box.  We do not have the routing infrastructure today in place to
multihome to your laptop/iPhone/tablet/Android/FB phone, something I
deeply regret we have not yet worked out. Maybe some day.

> , not because the standard was
> ever changed to require it. Desktops sitting behind home routers is no
> longer a sufficient model for the Internet; mobile devices are
> currently predominant and the Internet needs to adapt accordingly.
> Consider that mobile devices are multihomed having at least two
> network connections. We want the ability to seamlessly switch between
> networks (say from wifi to mobile) or between mobile networks as we
> drive down the road. Performing 3WHS is very expensive on mobile
> (literally for some of our users), so we need connections to survive
> across these path changes. If we hide the transport layer from the
> network devices (e.g. from home routers) then they can't enforce the
> single path assumption. In fact, once we disassociate location
> (addressing) from connection endpoint identification (like described
> in TOU) then connections should be able survive even across an address
> change and between two completely providers. This is of huge value to
> our users and IMO justifies encrypting the transport layer.

But the way this is done is through multiple pesistent transport
connections bound off of separate L3 local addresses.  We have attempted
to do otherwise through MIPv6 and LISP-MN.  Not widely deployed, and
even were they so, it is probably sufficient for something like the LISP
header to be above PLUS (think about that until you're 103)!