Problems with implementation - DoS attacks possible

Hello.


On Fri, 17 Jan 2003, Tom-PT Taylor wrote:

> Could people please look through this and see what else has to be done
> besides changing the signature algorithm codepoints as agreed yesterday.

I read through this document and found the following:

      Because HMAC key disclosure is done only after the end of the period
      of validity for the key, authentication of a given set of ICMP
      TRACEBACK messages requires that further messages be collected and
      examined beyond the period of interest, until the required key
      appears.  The processing entity SHOULD then verify the signature on
      the key before applying the key itself to validation of the message


I'm trying to catch some problems from the implementation point of view:

1.	Let's say attacker will flood me with ICMP Traceback messages (it
can, and WILL be implemented in stacheldraht-like software). So, I need to
collect all those messages until key for each of them will change and I
will be able to verify that particular message was fake. It is impossible
to implement that if I will get, let's say, 500000 ICMP Traceback messages
per second.

2.	There will be situations, when I will catch ICMP Traceback message
and will *never* see second message from that router/host/whatever because
that message was spoofed. So, it will not be possible to authenticate that
message. How long should I wait before flushing the particular ICMP
Traceback message from buffer?


What I'm saying here is that, IMHO,  there will be possible many attacks
based on filling up the buffers with collected ICMP Traceback messages.
The problem is that I need to collect ICMP Traceback messages for a period
of time and it will be impossible in some circumstances.


Anyways, the ICMP Traceback idea is great. We desperatelly need something
like this to stop those DDoS attacks.


---
Tomasz Grabowski  (0-91)4494234
Akademickie Centrum Informatyki
mailto:[email protected]