Subject: RE: [Ieprep] IPsec vs TLS for SIP message protection

From: "Nguyen, An" <[email-masked]>
Date: Tue, 25 Jun 2002 08:54:17 -0400

Ran,

>- TLS does not protect the IP header, as AH does.
>- TLS does not protect the actual TCP header, as either ESP or AH does.
>- TLS does not protect any UDP-based traffic, as either ESP or AH does.
>- Unlike ESP, the US has universally permitted export of AH because
   AH is authentication-only, while ESP can also be used for 
confidentiality.

I am still not sure how protecting IP header and datagram with AH and ESP is
better (than TLS) as far as Denial of Service attacks are concerned. I am
sorry I missed something here. To me, DoS means bringing servers down to
their knees by hackers (i.e., exhaust CPU resources) so that servers can not
provide any service to their clients. Maybe we can discuss this offline.

Regards,

An

_______________________________________________
Ieprep mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ieprep

---

From: RJ Atkinson <[email-masked]>
Date: Tue, 25 Jun 2002 09:46:35 -0400

On Tuesday, June 25, 2002, at 08:54 , Nguyen, An wrote:

> better (than TLS) as far as Denial of Service attacks are concerned.

Alice and Bob are hosts.  Alice and Bob are running SIP over TCP.
Adversary Charlie sends a forged message containing a TCP RST for
Alice & Bob's TCP session to either Alice or Bob or both.  That session
then disappears.

This is a denial-of-service attack.  The adversary took away Alice
and Bob's SIP session, which also removes their ability to send
signalling traffic for voice calls -- and which by extension
might remove or reduce their ability to send/receive certain voice calls.

> To me, DoS means bringing servers down to

Your definition is OK if you qualify it with "CPU denial-of-service 
attack".
There are many flavours of denial-of-service attack.  The one I outline 
above
might be called a "network denial-of-service attack".

To give an example that is both a CPU denial-of-service attack and a 
network
denial-of-service attack, consider that Charlie sends forged TCP SYN 
packets
really from Charlie, claiming to be from Alice, and destined for Bob.
Because Bob and Alice don't use AH or ESP to authenticate all their 
network
sessions, Bob erroneously believes that this is a legitimate attempt to 
start
a session by Alice (spends Bob's CPU generating a response, then spends
Alice's CPU responding to Bob's response; and consuming TCP state for 
both
of them).  This is a variant on the now well-known TCP SYN flood attack.

Feel free to drop me a unicast note if you want to chat more.

Cheers,

Ran
[email-masked]