Subject: [MSEC] MIKEY: Possible DoS by copying messages

From: Gerhard Strangar <[email-masked]>
Date: Thu, 13 May 2004 18:47:36 +0200

Hello,

Mikey draft 8 says (Section 9.5):

> This protocol is resistant to Denial of Service attacks in the sense
> that a Responder does not construct any state (at the key management
> protocol level) before it has authenticated the Initiator.

But I think - at least for the Diffie-Hellman method - authentication of
the sender is not sufficient. IMHO the Responder needs to verify if the
message was meant to be sent to him (e.g. by adding the Responder's ID
to the Initiator's message). Imagine an attacker who gains access to a
network with high traffic, let's assume 2 MIKEY message per second.
Let's further assume a timeout of 60 seconds after which MIKEY sessions
are closed.
If an attacker created a copy of all MIKEY messages and sent them to one
client, this client would either create 120 concurrent MIKEY sessions
(causing high CPU consumption) or reject to establish more than n
sessions.
In case of using pre-shared or public key transport, the client will not
run into the timeout, but detect an error immediately. However it might
already have wasted CPU cycles on doing an RSA decryption.

-- 
 * Origin: (2:2480/8057.2)

---

From: "Elisabetta Carrara (KI/EAB)" <[email-masked]>
Date: Mon, 17 May 2004 15:34:22 +0200

Hi Gerhard,
you have a good point.

The attack you describe does apply for a general case
where MIKEY is used independent of a signaling protocol. 
In a scenario such as SIP, a large number of Invites 
within a short time-frame would very likely not be 
accepted by the application.
Still, the protocol should mitigate this type of attack,
and your suggestion (the use of IDr) seems a good and simple
way.
 
Many thanks for pointing it out.

Cheers
/E

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Gerhard Strangar
> Sent: den 13 maj 2004 18:48
> To: [email-masked]
> Subject: [MSEC] MIKEY: Possible DoS by copying messages
> 

>already have wasted CPU cycles on doing an RSA decryption.

_______________________________________________
msec mailing list
[email-masked]
http://www.pairlist.net/mailman/listinfo/msec