[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
RE: Deprecation of AH header from the IPSEC tool kit
good point Paul - bad examples. 'Interesting' attacks though..
Here's the list of immutable (unchanging/protected header fields):
Version
Internet Header Length
Total Length
Identification
Protocol (This should be the value for AH.)
Source Address
Destination Address (without loose or strict source routing)
I guess the fact that TTL/frag stuff are exposed makes you wonder what use
it is protecting this lot!!
These would be DOS attacks that there is little automatic defense from.
Protection of option fields would be addressing a different spectrum of
attack.
Steve.
-----Original Message-----
From: Paul Koning [mailto:pkoning@xedia.com]
Sent: Thursday, June 15, 2000 5:03 PM
To: Stephen.Waters@cabletron.com
Cc: mcr@solidum.com; ipsec@lists.tislabs.com
Subject: RE: Deprecation of AH header from the IPSEC tool kit
>>>>> "Waters," == Waters, Stephen <Stephen.Waters@cabletron.com> writes:
Waters,> Although all sorts of attacks are possible, it is good to
Waters,> know when they are happening. With ESP-tunnel mode, the out
Waters,> header is exposed to various DOS attacks - like messing with
Waters,> the TTL, frag bits etc.
Waters,> For ESP-transport mode, the header and options fields are
Waters,> exposed.
Waters,> I think these are good reasons to use AH,...
AH won't help with attacks on TTL or frag bits because those are
mutable fields, they aren't authenticated because they cannot be.
Yes, with ESP transport mode the header and option fields are not
authenticated. If that matters it would be one thing. It doesn't
matter for IPv4. For IPv6 it may matter in a very limited set of
cases, though I'll want to look further before I'm convinced.
paul