Was it not decided earlier somewhere that the commit bit makes implementations susceptible to denial of services attacks? It seems an attacker can intercept a packet from the responder (or the other way, for that matter), set the bit and make the intended receiver then wait for the connected notification that will never come. Is this correct?
If so, then perhaps that concept created by the commit bit should be replaced by a "please wait" notification payload or the like that causes the recipient to wait for the connected notification.
A similar concept would also be necessary if implementations want to stop the race condition in aggressive mode...
---
Tim Jenkins TimeStep Corporation
tjenkins@timestep.com http://www.timestep.com
(613) 599-3610 x4304 Fax: (613) 599-3617
-----Original Message-----
From: Mason, David [mailto:David_Mason@nai.com]
Sent: Thursday, September 17, 1998 3:58 PM
To: Daniel Harkins
Cc: ipsec@tis.com
Subject: RE: issues with IKE that need resolution
> >> > For IKE the commit bit only makes sense in Quick Mode. Most people
>
Is it possible that someone somewhere at sometime might want to use
the commit bit in phase 1 for Aggressive Mode?
-dmason