Re: [Spud] The reset middleboxes attack

[Phillip Hallam-Baker <[e-mail]>]

On Sun, Mar 29, 2015 at 4:28 AM, Yoav Nir <[e-mail]> wrote:

> Hi, Christian
>
> I understand the issue. Is this something we are really worried about? It has always been possible to do this with TCP by sending a RST, and that worked on the endpoints as well, and TLS has never protected us from that attack.
>
> To get the solution to work, presumably the initiator generates a secret and sends its has in the OPEN command. This allows the initiator to close the connection by sending the pre-image. But what if we want both sides to be able to close the connection? We either need to transmit the pre-image in the encrypted part of the protocol (what Joe’s architecture diagram calls “transport”), or we need a per-endpoint hash, requiring the responder to also send a hash in the ACK command. The latter doubles the state on the middlebox.

The problem with state these days is not size. It is the fact you need
state because once a path is stateful it is fixed.

If I have a stateless protocol like DNS over UDP, it does not matter
which server/host my packets end up at. If I have to keep one byte of
state then it does. That is what causes problems. Here we have already
accepted that the middleboxen is stateful

Raspberry Pi 2 comes with 1GB of RAM for $40. The chip is much
cheaper. It is going to run out of horsepower long before it runs out
of RAM.

RST attacks are real and are used as attacks against TCP. So it is
worth the freight