RE: security policy discovery

["Satyadeva Konduru" <skonduru@caymas.com>]

> One could imagine, however, Bob seeing the unprotected
> packet and letting that trigger an IKE SA setup. The
> initial TCP SYN would be dropped, but if it was still
> being retried when the ESP SA comes up, Alice would send
> one of the retried packets inside the ESP SA and the
> conversation would ensue. Alternately, one could
> imagine Bob passing on a limited class of packets (like
> TCP SYN) and letting the response packet trigger the
> setup of the ESP SA.

In this scenario, is there not a problem of spoofed packets
unnecessarily setting up tunnels between Bob and Alice. Each think that
the other side needs a tunnel to send traffic. This could become a
denial of service attack, especially if the lifetimes are small, since
both Bob and Alice will keep setting up tunnels and thus make the setup
of genuine tunnels slow.

-Satyadeva Konduru
Caymas Systems Inc.