Re: Problems with implementation - DoS attacks possible

Hello,

IMHO, it is possible if the flow of processing is adjusted.

(1) The collector's driver handles that if the message is ICMP traceback,
     copy the message from NIC's buffer-0 to buffer-1, first.

(2) The collector handles that if the ICMP traceback message in the buffer-1
     is not valid as a result of the authentication, flushing the message
     or move it to another buffer-2, second.

(3) Finally, the buffer-1 keeps only valid ICMP traceback message.

I think the problem is how to keep the speed of authentication.

   i)   Increase the size of buffer-1
   ii)  Accelarate the process of authentication
   iii) Configure the lifetime of the key much longer

If the buffer problem is in buffer-0, it's NIC's problem, it will be
  better to change enough buffer's NIC.


At 14:29 03/01/20 +0100, Tomasz Grabowski wrote:

>Hello.
>
>
>On Fri, 17 Jan 2003, Tom-PT Taylor wrote:
>
> > Could people please look through this and see what else has to be done
> > besides changing the signature algorithm codepoints as agreed yesterday.
>
>I read through this document and found the following:
>
>       Because HMAC key disclosure is done only after the end of the period
>       of validity for the key, authentication of a given set of ICMP
>       TRACEBACK messages requires that further messages be collected and
>       examined beyond the period of interest, until the required key
>       appears.  The processing entity SHOULD then verify the signature on
>       the key before applying the key itself to validation of the message
>
>
>I'm trying to catch some problems from the implementation point of view:
>
>1.      Let's say attacker will flood me with ICMP Traceback messages (it
>can, and WILL be implemented in stacheldraht-like software). So, I need to
>collect all those messages until key for each of them will change and I
>will be able to verify that particular message was fake. It is impossible
>to implement that if I will get, let's say, 500000 ICMP Traceback messages
>per second.

>2.      There will be situations, when I will catch ICMP Traceback message
>and will *never* see second message from that router/host/whatever because
>that message was spoofed. So, it will not be possible to authenticate that
>message. How long should I wait before flushing the particular ICMP
>Traceback message from buffer?
>
>
>What I'm saying here is that, IMHO,  there will be possible many attacks
>based on filling up the buffers with collected ICMP Traceback messages.
>The problem is that I need to collect ICMP Traceback messages for a period
>of time and it will be impossible in some circumstances.
>
>
>Anyways, the ICMP Traceback idea is great. We desperatelly need something
>like this to stop those DDoS attacks.
>
>
>---
>Tomasz Grabowski  (0-91)4494234
>Akademickie Centrum Informatyki
>mailto:[email protected]

----------------------------------------------------------------------------------------
Naohiro Fukuda
Matsushita Electric Works, Ltd.
Network Security Team
New Business Promotion Division
Address:        5-13-2, Mita, Minato-ku, Tokyo 108-8351, Japan
Tel:    +81-3-3452-3390 Fax:    +81-3-5442-9156
(MIC-TEL)  :7-331-4856     (MIC-FAX)  :7-331-4869
E-mail: [email protected]
Homepage:       http://www.nais-netcocoon.com
----------------------------------------------------------------------------------------