Subject: [Hipsec] Issue #5: state machine bug

From: [email-masked] (Henderson, Thomas R)
Date: Fri Dec 12 11:33:01 2003

> -----Original Message-----
> From: Petri Jokela [mailto:[email-masked]]
> Sent: Thursday, December 11, 2003 11:30 PM
> To: [email-masked]
> Subject: Re: [Hipsec] Issue #5: state machine bug
>=20
>=20
> Henderson, Thomas R wrote:
> > iii) if, however, we decide to respond, why respond with
> > an R1?  Why not an I1 or a new packet type (see below)?
>=20
> A question related to sending the R1 when an unknown SPI is received:
>=20
> If A and B have an established connection between them (both in E3=20
> state). Now, our attacker, C, decides to send a fake packet=20
> with unknown=20
> SPI to the A using B's source IP address. What will the A host do?
>=20
> A sends R1 to B, while the A-B connection still remains in=20
> the E3 state=20
> (the sent R1 doesn't have any effect on this). However, B gets an R1=20
> packet and thinks that A has lost the state, maybe rebooted.=20

B would discard the R1 in general based on Birthday count.

The potential attack is if C could somehow get A to bump its
birthday count first.  If C and A have an association that times out=20
and is restarted, birthday would increase (note that in Section 4.1.3,=20
there is a statement that "The Birthday also has to be increased in=20
accordance with the system's SA timeout parameter.").  However, if A and =

anyone else have an association that times out, C could take advantage=20
of the Birthday count (C could probe A with I1s intermittently to=20
find A's current birthday count).  So anytime a machine increments
its birthday count, under the current rules, it could expose all active
associations to a "fake reboot" attack.