Subject: [IPsec] Issue 18: Port in anti-DoS cookie

From: Yoav Nir <[email-masked]>
Date: Mon, 22 Sep 2008 18:11:34 +0300

Tero said:
>>    A good way to do this is to set the responder cookie to be:
>>
>>    Cookie = <VersionIDofSecret> | Hash(Ni | IPi | SPIi | <secret>)
>
> I was starting to wonder if that Cookie should also include the Port
> part, especially in the NAT-T case?

The attack that the cookie mechanism is supposed to foil is a DoS  
attack using IKE_SA_INIT packets with a spoofed source. I don't see  
how adding the source port to the cookie calculation helps avoid this.

In the NAT-T case, two initiators behind the same NAT device will have  
the same IP address but different ports. If their PRNG is so bad that  
they both generate the same Ni and SPIi, then they will get the same  
cookie, but in that case, that's probably the least of their problems.  
It still does not increase the DoS threat to the responder, because  
each initiator has the "right" to use the NAT box IP address.

At any rate, this is not part of the protocol, and is just a  
suggestion for implementers.

I suggest that unless someone can describe an attack on the current  
version, that we leave this as is.

Yoav

_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Tero Kivinen <[email-masked]>
Date: Tue, 23 Sep 2008 13:16:27 +0300

> version, that we leave this as is.

That is ok for me.

This was mostly just something that popped up to my head when reading
the document, and as I didn't want to start wasting too much time
thinking it at that time, I just marked it down so it will get checked
down. I have not found out any working attack against the current
version so it can stay as it is now.
-- 
[email-masked]
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Paul Hoffman <[email-masked]>
Date: Tue, 23 Sep 2008 09:09:31 -0700

>version so it can stay as it is now.

OK, then we can close this one off.

--Paul Hoffman, Director
--VPN Consortium