Subject: [Hipsec] bug in E3 in the state machine?

From: [email-masked] (Henderson, Thomas R)
Date: Thu Nov 6 20:02:01 2003

How do we know that the ESP packet corresponds to a HIP SA and not
an IKE SA if we have lost our state?  Shouldn't there be a more
general response at IPsec or ICMP level (rather than responding at=20
HIP level) to the receipt of an unknown SPI?  Or no response at all
in some scenarios? (this seems like a potential means to circumvent=20
policy controls on who a responder may elect to send an R1 to)

> -----Original Message-----
> From: Julien Laganier [mailto:[email-masked]]
> Sent: Monday, November 06, 2000 9:53 AM
> To: Henderson, Thomas R
> Cc: Miika Komu; HIPsec; Robert Moskowitz
> Subject: Re: [Hipsec] bug in E3 in the state machine?
>=20
>=20
>=20
> Hi Tom,
>=20
> The section "5.3 Reboot and SA timeout restart of HIP" says:
> -----------------------
>    If a system receives an ESP packet for an unknown SPI, the=20
> assumption
>    is that it has lost the state and its peer did not. In=20
> this case, the
>    system treats the ESP packet like an I1 packet and sends an R1
>    packet.  The initiator HIT is typically NULL in the R1, since the
>    system usually does not know the peer's HIT any more.
>=20

>=20
>=20

---

From: [email-masked] (Pekka Nikander)
Date: Fri Nov 7 03:11:00 2003

Henderson, Thomas R wrote:

> general response at IPsec or ICMP level (rather than responding at 
> in some scenarios? (this seems like a potential means to circumvent 

Very good question.  If I remember correctly (probably not),
the IPsec folks decided not to have this kind of functionality.
Indeed, the current IPsec architecture doesn't support any
notification of receiving packets with an unknown SA.  One
possible reason for that might have been that such indications
would allow an attacker to learn which SAs are in use and which
are not, and that might be a security risk.  (At the very high
security levels it most probably is a security risk, but HIP
is not really designed to be that secure, but more as a
*practical* security solution.)

Hence, this feature in HIP is very much experimental, and more
or less reverses the decision that the IPsec WG made.  I'd
suppose Bob can tell us more about the background.

--Pekka Nikander