Re: SOI QUESTION: 3.1 DoS protection

[Jean-Jacques Puig <jean-jacques.puig@int-evry.fr>]

Hi,

> 3.1.A) WRT DOS attacks that exhaust memory or CPU resources, is it more 
> important to always keep the message count at 4, or is it acceptable to add 
> an additional roundtrip of messages when the responder thinks he's under 
> attack?

Unless the 6 messages approach allows to shorten some messages (mess 3, 
more accurately) enough to prevent from udp fragmentation DOS, I don't see it's
advantage for 'ip level' DOS protection: 4 messages should be enough for it.

A 6 messages scenario may help to reduce the protocol complexity and to provide 
better understanding. As I like the paranoid position of thinking we are always
under attack, and because I believe SOI should be as stupid as possible, I wonder
if even the 4 messages + 1 roundtrip under attack is not already too complex by
introducing a variant.

In a nutshell, my question is: Is it costly to do systematically with 6 messages ?
Have we got a sufficient experience/feedback on ike main mode to know if 6 is 
usually too many, or if it is always bearable ? I am sorry if it has been discussed
before, but I could not find any piece of information which would help me to make up
my opinion on this point.

I think Phill's advise about using a locator url in order to retrieve auth info
should be considered in order to tackle mess 3 length' problem. But care must be taken
that it does not allow to work indirect attack against the url. Using locator url may
also enable DOS thanks to DNS poisonning, but it may happen also when using certificates 
(with a pki).

> 3.1.B) WRT UDP fragmentation attack protection, both IKEv2 and JFK provide 
> basically equivalent protection. Does anyone care about the details of how 
> JFK or IKEv2 provide this functionality.

I don't care about the details, but as I think some layer violation is likely to happen,
this violation should be as ``clean'' as possible (I know that's a bit unclear, sorry).

> 3.1.C) Is it important to have precomputation of exponentials available for 
> use as a mechanism for protecting against cpu consumption attacks?

I think it is an implementation matter, though it should usually be a good idea.

--
Jean-Jacques Puig