[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: A pothole in ISAKMP/Oakley
> You are right. But since Quick Mode Exchange is proteted
> (encrypted and authenticated) by the phase 1 ISAKMP SA,
> clogging attack should not be a big problem.
Maybe we are talking about different attacks. The requirement for AH
and ESP SPI generation was there before there was key management. We
should ask why. I'd guess that the worry has been that an attacker
could predict the SPI sequence and insert bogus messages with valid
SPI's into the traffic stream, forcing the recipient to go through at
least the trouble of checking the hash if not also decrypting.
Hilarie
Follow-Ups:
References: