Re: Problems with implementation - DoS attacks possible

Hello,

At 10:40 03/01/21 +0100, Mikael Olsson wrote:


>Tomasz Grabowski wrote:
> >
> > There will be situations, when I will catch ICMP Traceback message
> > and will *never* see second message from that router/host/whatever because
> > that message was spoofed. So, it will not be possible to authenticate that
> > message.


>Ugh. Good catch. Even on something as slow as a 2Mbps link, one would
>need 15MB of itrace packet storage to be able to wait for key disclosure
>with a one-minute delay. (And this assumes that one can put the packets
>back-to-back with no waste!)
>
>What kind of intervals are we talking about for the delayed key
>disclosure algorithm to give meaningful protection?
>(Coffee hasn't kicked in yet; I'm having problems envisioning the
>  failure modes and attack venues on delayed key disclosure.)

If attacker will send ICMP tarceback messages with various fake authentications,
CRLs request will also be issued for the validation. If many classed CAs exsist,
  it will be delayed much more.

I think if it is not realtime traceback, it can be meaningful for forensics.


> > How long should I wait before flushing the particular ICMP
> > Traceback message from buffer?
>
>Doing first-in/first-out on unauthenticated messages seems like
>the natural choice, but if key disclosure is too slow, it also
>guarantees 100% success for an attacker.  Maybe dropping random
>packets is a better way.  But that requires a more dynamic allocation
>scheme than back-to-back packet storage, which increases the memory
>demands!
>
>
>--
>Mikael Olsson, Clavister AB
>Storgatan 12, Box 393, SE-891 28 ヨRNSKヨLDSVIK, Sweden
>Phone: +46 (0)660 29 92 00   Mobile: +46 (0)70 26 222 05
>Fax: +46 (0)660 122 50       WWW: http://www.clavister.com

----------------------------------------------------------------------------------------
Naohiro Fukuda
Matsushita Electric Works, Ltd.
Network Security Team
New Business Promotion Division
Address: 5-13-2, Mita, Minato-ku, Tokyo 108-8351, Japan
Tel: +81-3-3452-3390 Fax: +81-3-5442-9156
(MIC)  :7-331-4856 (MIC-FAX)  :7-331-4869
E-mail: [email protected]
English Homepage: http://www.netcocoon.com
Japanese Homepage: http://www.nais-netcocoon.com
----------------------------------------------------------------------------------------