Subject: RE: [Mobike] New issue 18: Threat discussion

From: <[email-masked]>
Date: Thu, 2 Sep 2004 14:23:32 -0400

Hi Pasi,

Why are we in MOBIKE trying to solve "transient pseudo-NAT" attack?
The problem is of general nature, and will impact IP, IPsec traffic
as much as (MOB)IKE traffic. 

Any solution to this attack has to be of general nature rather than
MOBIKE-specific solution just working for MOBIKE.

Just trying to understand....

Best,
Atul

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]]On
> Behalf Of ext 
> Sent: Tuesday, August 24, 2004 11:30 AM
> To: [email-masked]
> Subject: [Mobike] New issue 18: Threat discussion
> 
> 
> At the San Diego meeting I promised to create a new issue
> about the various threats the protocol should consider.
> 
> So far, we have at least the following (notation: the IKE
> peers are A and B; C is an innocent victim).
> 
>   1) Unauthenticated attacker directs the traffic stream
>      from B to a third party C, with the intent flooding C
>      with unwanted traffic.
> 
>   2) Authenticated peer A directs the traffic stream from B
>      to a third party C, with the intent of flooding C with
>      unwanted traffic.
> 
>   3) Unauthenticated attacker directs the traffic stream
>      from B to somewhere (perhaps to the attacker or /dev/null), 
>      with the intent of preventing the legitimate peers from 
>      communicating.
> 
>   4) Unauthenticated attacker causes the IKE_SA to be
>      closed by modifying just one or two IKE packets (if
>      attacker can modify all packets, he can of course DoS).
> 
> Do we have any other threats, assuming we don't need to 
> repeat those where MOBIKE doesn't change anything in
> normal IKEv2? Should we add some discussion about these 
> to the design document and/or protocol proposals?
> 
> (BTW, a comment about terminology: Francis has quite
> consistently called case 1 "transient pseudo-NAT attack" 
> and case 2 "third party bombing". I (and several others) 
> have sometimes called both 1 and 2 third party bombing.)
> 
> Cheers,
> Pasi
> _______________________________________________
> Mobike mailing list
> [email-masked]
> https://www.machshav.com/mailman/listinfo.cgi/mobike
> 
_______________________________________________
Mobike mailing list
[email-masked]
https://www.machshav.com/mailman/listinfo.cgi/mobike

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Thu, 2 Sep 2004 17:05:36 -0700

Pasi,

Couple of questions
----------------------------------

mohanp> Is this attack where the unauthenticated attacker is modifying
mohanp> the packets of the authenticated client or doing the attack
mohanp> independently ?

mohanp> Why is this different from (1) ?

Cheers,
Pasi

-mohanp

---

From: <[email-masked]>
Date: Fri, 3 Sep 2004 15:43:04 +0300

Mohan Parthasarathy wrote:
> Is this attack where the unauthenticated attacker is modifying
> the packets of the authenticated client or doing the attack
> independently ?

Both cases need to be considered, but obviously handling the
latter one should be very easy. 

> Why is this different from (1) ?

Hmm... perhaps it's not different (Francis also suggested
that they should be merged).

Best regards,
Pasi