[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: IPSec SA DELETE in "dangling" implementation

What I should have said was, maybe dead peer detection should not rely
upon IKE. That is, maybe IKE is the wrong vehicle.

Slava Kavsan wrote:
> 
> "Scott G. Kelly" wrote:
> 
> > Maybe dead peer detection should not rely upon the presence of an IKE
> > SA.
> 
> I like this approach, but it needs to be further analysed:
> 
> - are there any attacks possible when using unprotected NOTIFYes for keep-alive? E.g. is
> "false-alive" attack is really an attack?
> - what if protected keep-alives are used when possible (IKE SA is around) and non-protected
> when there is no IKE SA?
> - use of keep-alives in this fashion will prevent us from taking advantage of using Ack-ed
> NOTIFY for keep-alives, because Ack-ed NOTIFY is always protected (unless this requirement can
> be relaxed for keep-alives)
> - could resource-minded implementations when they need more memory "shrink" their SAs (instead
> of deleting them) to a bare minimum to only support keep-alive protection?
> - could we use (somehow) IPSec-based keep-alives
> - etc.
> - etc.


Slava Kavsan wrote:
> 
> "Scott G. Kelly" wrote:
> 
> > Maybe dead peer detection should not rely upon the presence of an IKE
> > SA.
> 
> I like this approach, but it needs to be further analysed:
> 
> - are there any attacks possible when using unprotected NOTIFYes for keep-alive? E.g. is
> "false-alive" attack is really an attack?
> - what if protected keep-alives are used when possible (IKE SA is around) and non-protected
> when there is no IKE SA?
> - use of keep-alives in this fashion will prevent us from taking advantage of using Ack-ed
> NOTIFY for keep-alives, because Ack-ed NOTIFY is always protected (unless this requirement can
> be relaxed for keep-alives)
> - could resource-minded implementations when they need more memory "shrink" their SAs (instead
> of deleting them) to a bare minimum to only support keep-alive protection?
> - could we use (somehow) IPSec-based keep-alives
> - etc.
> - etc.
References: