Subject: Re: [IPsec] DDoS draft next steps - CAPTCHA

From: Yoav Nir <[email-masked]>
Date: Thu, 10 Sep 2015 19:38:45 +0300

> On Aug 14, 2015, at 7:08 PM, Valery Smyslov <[email-masked]> wrote:
> 
>>>> With no hat on, I hate captchas.  I sometimes don't see it well enough
>>>> depending on the images selected and have not used applications as a
>>>> result.  It is a clever way to tackle the problem, so it would be up
>>>> to the deployer to make sure their captcha images didn't prevent
>>>> expected and authorized users from connecting.
>>> 
>>> To be frank I hate them also as a user in real life.
>>> But any kind of puzzle solution (be it captca or
>>> cryptographic puzzle) would annoy users (additional delays, battery power consumption etc.).
>> captcha's also assume there is a user to talk to, which might not always
>> (or even mostly) be the case.
> 
> Yes, I wrote in my original e-mail that this is not appropriate
> for "unattended" devices. For those cryptographic puzzles are left.
> This is appropriate mostly for smartphones.

[with vendor hat on]

Some of the IPsec gateways are not big devices with powerful CPUs. There are VPN gateways that double as home routers and Firewalls/VPN gateways specifically made for branch offices (think of the sales office from Glengarry Glen Ross with 3 employees, some of whom are always out). These gateways are made with general-purpose CPUs too weak to put in anything but the lowest of low-end phones, plus they come with a single core. Their ability to solve cryptographic puzzles is even lower than that of phones.

[hat off]

So if a flood of IKE requests can make the center gateway effectively lock out all the branch offices, then we are only helping to make this DDoS attack successful.

If we recognize the need to support weak unattended devices as a requirement, then we need an answer for this class of devices. A one-time reauthentication token is one possibility, but making sure it is not replayed requires storage on the Responder. We could come up with a scheme such as this:
 - Cryptographic puzzle - for powerful (enough) initiators.
 - Captcha (optional) - for weak initiators with a UI
 - Reauthentication token - for weak, unattended devices that have previously connected.

Yoav

---

From: Tero Kivinen <[email-masked]>
Date: Fri, 11 Sep 2015 14:34:53 +0300

Yoav Nir writes:
> [with vendor hat on]
> 
> Some of the IPsec gateways are not big devices with powerful CPUs.
> There are VPN gateways that double as home routers and Firewalls/VPN
> gateways specifically made for branch offices (think of the sales
> office from Glengarry Glen Ross with 3 employees, some of whom are
> always out). These gateways are made with general-purpose CPUs too
> weak to put in anything but the lowest of low-end phones, plus they
> come with a single core. Their ability to solve cryptographic
> puzzles is even lower than that of phones. 
> 
> [hat off]
> 
> So if a flood of IKE requests can make the center gateway
> effectively lock out all the branch offices, then we are only
> helping to make this DDoS attack successful.

Those offices should use bit of money and get static IP-address, so
they can be configured to the VPN gateway so that for those
IP-addresses we just do cookie exchange while under attack, but do not
require puzzles...
-- 
[email-masked]