Re: Problems with implementation - DoS attacks possible

Tomasz Grabowski wrote:
> 
> There will be situations, when I will catch ICMP Traceback message
> and will *never* see second message from that router/host/whatever because
> that message was spoofed. So, it will not be possible to authenticate that
> message. 

Ugh. Good catch. Even on something as slow as a 2Mbps link, one would
need 15MB of itrace packet storage to be able to wait for key disclosure 
with a one-minute delay. (And this assumes that one can put the packets
back-to-back with no waste!)

What kind of intervals are we talking about for the delayed key 
disclosure algorithm to give meaningful protection?
(Coffee hasn't kicked in yet; I'm having problems envisioning the
 failure modes and attack venues on delayed key disclosure.)


> How long should I wait before flushing the particular ICMP
> Traceback message from buffer?

Doing first-in/first-out on unauthenticated messages seems like 
the natural choice, but if key disclosure is too slow, it also
guarantees 100% success for an attacker.  Maybe dropping random
packets is a better way.  But that requires a more dynamic allocation 
scheme than back-to-back packet storage, which increases the memory
demands!


-- 
Mikael Olsson, Clavister AB
Storgatan 12, Box 393, SE-891 28 ÖRNSKÖLDSVIK, Sweden
Phone: +46 (0)660 29 92 00   Mobile: +46 (0)70 26 222 05
Fax: +46 (0)660 122 50       WWW: http://www.clavister.com