Re: [tcpm] tcp-auth-opt issue: support for NATs

At Thu, 07 Aug 2008 12:09:49 -0700,
Joe Touch wrote:
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Hi, Eric,
> 
> <indiv hat on>
> 
> Eric Rescorla wrote:
> |> <indiv hat on>
> |> If we ignore source IP addresses, we probably end up needing to go
> |> through a set of possible keys when a SYN arrives.
> |
> | Well, not if you use unique key-ids.
> 
> I've noted before that I don't think it's a good idea to assume
> cryptographic properties of fields in the header or option except for
> the MAC.

Well, I don't think of this as a cryptographic property. All that's
required is a relatively even distribution of key-ids. They need
not be secret.

> | Well, that's certainly true at some level, but if you use any
> | randomness at all in key-id assignment, you would expect to have
> | about N/256 key-ids where N is the number of keys. Unless N is
> | very large, the number of duplicate key-ids is likely to be high
> | enough that this doesn't seem like a very impressive attack,
> | especially since the attacker can force you to compute a MAC with
> | *every* packet he sends, not just SYNs.
> 
> N could easily be fairly large, e.g., in peer-to-peer hubs. Note that
> this should be an issue only for SYNs; once a connection is made, the
> socket pair is already static (by TCP rules), so the appropriate key for
> that socket pair (thus determined during the SYN handling) can be
> installed - e.g., by a link.

That just removes the amplification angle. The attacker can still
force the victim to do one MAC computation per transmitted 
packet.

-Ekr
_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www.ietf.org/mailman/listinfo/tcpm