Re: [tcpm] New I-D posted : draft-moncaster-tcpm-rcv-cheat-00

On Wed, Feb 21, 2007 at 10:23:17AM +0000, Gavin McCullagh wrote:
> Hi,
> 
> On Tue, 20 Feb 2007, Rob Sherwood wrote:
> 
> > Should people decide that this two phases approach is preferable, it
> > might be possible to simplify the first phase test as follows.  Rather
> > then reordering segments N-1,N,N+1,..,N+D to N-1,N+1,..,N+D,N as Toby
> > et. al suggest, it might be better to more frequently perform this test
> > with D=1, (i.e., simply swap the order of two sequential segments) and
> > after some threshold number K failures, apply the second phase randomly
> > skipped segment test.
> 
> Perhaps I misunderstand, but is it not necessary to have variation in D of
> at least 
>         0 < D < 4
> for the attack to be definitively prevented?
> 
> The "lazy ack" form of the attack just omits duplicate acks in order that a
> loss is never detected.  If the above were implemented with D=1 it appears
> that an attacker could always send the first duplicate ack in response to a
> missing packet but omit the second or third duplicate ack.  This would seem
> to allow the attack to continue but also pass the N-1,N+1,N test.
> 
> I guess if lots of packets are being lost as part of the attack this kind
> of precision may be impossible on the part of the attacker so maybe the
> above is not so important.

Your last paragraph sums it up correctly, IMHO.  If the receiver is
actually receiving all packets, then of course it can defeat any test
-- but then there is no attack.  With Lazy ack, if the receiver were
dropping some constant percentage of packets p, then over n tests,
we can expect the receiver to fail p*n tests, and this solution can
be engineered so that k (the number of failed tests before phase 2)
is chosen to prevent the amplification rate from being too high.

In an alternate attack, the attacker could duplicate ack all packets,
but then the amplication factor suffers (1 data packet/(D+1) acks ==
1500/(D+1)*40 == 37.5x/(D+1)).   Maybe it does make sense to consider
D>1 such that the amplification factor suffers more.  Obviously, D>37,
i.e., the value the prevents *any* amplification, is too large for
practical considerations, but it does make the case for a larger value
of D (contrary to what I was suggesting earlier).

- Rob
.

_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www1.ietf.org/mailman/listinfo/tcpm