|
Posted by =?ISO-8859-1?Q?Lassi_Hippel=E4 on September 6, 2006, 2:56 am
If you were Registered and logged in, you could reply and use other advanced thread options
> Thanks for your response. Maybe I hadn't made a clear description. My
> problem is that: when an agent receives an encrypted message (signature
> message we assume here), without apparent fields of message sequence
> number in protocol and sender's ID, how does he rapidly get know which
> message in which protocol this message is and which keys should he use
> to decrypt the message.
If the message has no cleartext hints about sender/session, the
recipient has to try each active security association to see which one
matches. That is bad. It puts lots of computational load on the
recipient. An attacker can send bogus packets to overload the recipient.
BTW, modern protocols try to do the opposite. To initiate a session the
other end has to compute a "puzzle" before the recipient dedicates any
resources to the negotiation. That way the attacker can't overload the
machine unless she has an even bigger machine.
-- Lassi
> Lassi Hippeläinen wrote:
>> wt.eric@gmail.com wrote:
>>> In many protocols under academic discussion (like NSPK protocol,
>>> Big-mouth-frog protocol, etc) there is no an apparent field in some
>>> messages that shows which step in which protocol this message is and
>>> who is the sender of this message, is it a problem?
>> As a general answer (I'm not familiar with the protocols in question):
>> yes. This is a potential DoS attack vector. If an attacker can inject
>> messages into the stream, they can knock the state machines out of sync.
>> Even worse attacks, e.g. session hijack, could be possible if the
>> protocols aren't designed against it.
>>
>> That's why many protocols carry cookies or nonces as a security feature.
>>
>> -- Lassi
>
| 
XML site map