Subject: [AVTCORE] UKS attacks on RFC 4572

From: Martin Thomson <[email-masked]>
Date: Mon, 10 Oct 2016 15:04:24 +1100

Ekr and I have put together a short draft explaining how RFC 4572 is
vulnerable to UKS attacks.

https://datatracker.ietf.org/doc/draft-thomson-avtcore-sdp-uks/

In short, this is a monstrously boring attack with a laughably large
set of preconditions necessary to mount.

That said, the day has long passed where we can afford to ignore
security issues, even the boring ones.  The draft contains proposals
for mitigations that (with the help of Thyla van de Merwe) we have
verified to be correct.  Thanks also to Karthik Bhargavan who helped
to identify and analyze the attack.

--Martin