Re: [Tsvwg] WGLC for Port Randomization starts now (April 1st)

["Brian F. G. Bidulock" <[e-mail]>]

Randy,

Randy Stewart wrote:                          (Thu, 28 May 2009 11:15:27)
> 
> If you don't keep a timed wait, then you could get old packets
> injected on a new association.. for example an ABORT could
> be tossed at you from an old association where you re-used
> the vtag...

I'm not sure that a time-wait will do that either: that is: When
all the vtags are in timed-wait what will you do?  If you refuse
the connection there is a DoS attack waiting to be exploited. If
you go with a vtag in timed-wait then you have a risk, just as
other approaches.  Just putting a vtag into timed-wait risks a
DoS attack.

For example, using a cryptographically generated vtag (which they
need to be anyway) the chances of reusing a vtag within a window
are very slim.  The chances get better when there are more
associations formed and dropped within a time window, just as with
your approach.  However, a cryptographical approach does not consume
memory per vtag and is therefore not vulnerable to these expoits.

--brian

-- 
Brian F. G. Bidulock
[e-mail]
http://www.openss7.org/