Re: Is IP address spoofing possible with ESP transport mode?

Son,

Enabling Perfect Forward Secrecy (PFS) will encrypt the entire packet in 
ESP--inculding the header.  If you can't enable that, someone could see 
your src IPs and try to spoof packets, but it's far from a huge risk, IMHO.

You have to get past phase1 to get to phase2, for starters.  For phase1 
(establishing the initial SA) the source IP address is sent in the 
clear, but there is no real alternative to that.  Your device and the 
distant end device have to do an initial key exchange, so they have to 
know how to talk to each other and where the other end lives.  It's a 
two-way handshake though, and the actual exchange of keys is done 
encrypted. 

A spoofed IP address in this case doesn't really do an attacker any good 
because the handshake would fail unless the guy knows the pre-share (or 
has a copy of the certificate), knows the parameters for both sides of 
the tunnel, and can route the spoofed IP address to a device he controls 
vs whoever controls the spoofed IP address.  If that's the case, you 
have bigger problems than headers being sent in the clear. 

I understand your concern, and I'm not an uber-31337 4aXX0r so there may 
be a couple things I'm missing, but I wouldn't lose much sleep over it.

Cheers,

Travis


Son Phan wrote:

>Hello IPSec folks,
>
>As far as I know IP header is not protected in ESP mode, so in transport 
>mode the source IP may be modified.
>
>Imagine the following scenario:
>
>-Bad guy Bob setup an transport ESP SA with server S. The SA is 
>identified by S's IP address, SPI and SA mode (ESP)
>
>-After setting up this SA, Bob send an IP packet protected with this SA's 
>parameter, but put Victim Alice's IP address as into source IP address. 
>As {dest_IPaddr, SPI, mode} trio point to the valid SA, the packet can 
>be decrypted successfully. However the result will be a IP with fake 
>source IP address.
>
>Question:
>-Can that case really happen or did I miss something?
>
>-There is a source address field in SA. Is it mandatory to check this value 
>against the source IP address to protect the above case? I have some 
>doubt about it as it can be wildcast in many cases.
>
>-Is there any measure to protect the case described here?
>
>Thanks in the advance,
>Son
>_______________________________________________
>VPN mailing list
>[email protected]
>http://lists.shmoo.com/mailman/listinfo/vpn
>
>
>  
>