Re: [TLS] comparison of draft-josefsson-salsa20-tls-02 and draft-agl-tls-chacha20poly1305-02

[Nikos Mavrogiannopoulos <[e-mail]>]

On 10/23/2013 05:42 PM, Eric Rescorla wrote:

>     as a general comment I think DTLS' resilience on forged packets
>     isn't that good. It makes it a perfect target to lay an attack. I think
>     it would be much better to have a limit by default on the allowed
>     packets with wrong MAC.
> S 4.2.7 provides some guidance in this area, but it's pretty vague:
> 
>    Note that Alert messages are not retransmitted at all, even when they
>    occur in the context of a handshake.  However, a DTLS implementation
>    which would ordinarily issue an alert SHOULD generate a new alert
>    message if the offending record is received again (e.g., as a
>    retransmitted handshake message).  Implementations SHOULD detect when
>    a peer is persistently sending bad messages and terminate the local
>    connection state after such misbehavior is detected.
> It certainly seems like it would be a good thing to document some
> better guidance about how many bad MACs you should tolerate.
> Do you have any thoughts about what makes sense?

I was thinking of disabling wrong MAC tolerance completely if the
underlying layer has checksums. UDP for example has checksums and
packets that are altered due to transmission errors will be discarded
anyway. In lower protocols such as ethernet we also have checksums.

If someone needs to transmit in raw without any checksums, he could
exceptionally allow wrong MAC tolerance.

regards,
Nikos