[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
RE: Heartbeats draft (fwd)
> -----Original Message-----
> From: CHINNA N.R. PELLACURU [mailto:pcn@cisco.com]
> Sent: 27 March 2000 22:51
> To: ipsec mailling list
> Subject: RE: Heartbeats draft (fwd)
>
>
> some thoughts on Heartbeats:
>
> SPI lists: I feel that this approach to maintain
> synchonization between
> the SADs of two peers is not going to scale well. It's going
> to be very
> expensive to send the SPI list, and also check the SAD against the SPI
> list, as the number of SAs increase. I feel that implementing
> acknowledged
This is only the list of SPIs from on peer to the other - I don't see any
great need for this to grow dramatically. Even if it is large, the protocol
allows for a portion of the list to be transmitted each time. In this way
the processing effort can be maintained at a constant level at the expense
of a longer verification period.
The point about the heartbeat protocol is that it is relatively resistent to
DOS attacks. This is particularly true if the heartbeat traffic is
indistinguishable from regular traffic. In this case it can't be
selectively deleted and limits the possibility of holding back traffic. In
any case if an attacker can delete and insert datagrams at will then there
are plenty of attacks he can make.
Where the heartbeat protocol is stronger is that it can't be provoked into
generating traffic or renegotiating SAs by spoofed traffic. If one peer has
gone down then the 'cheap' basis for authentication has gone. This means
that spoofed traffic can force either one end to generate an expensive
signature or the other end to renegotiate SAs, depending on whether
authentication is used or not.
Chris
Follow-Ups: