Subject: [IPsec] draft-ietf-ipsecme-ikev2-resumption-00.txt fragmentation

From: "Hui Deng" <[email-masked]>
Date: Tue, 18 Nov 2008 23:18:47 +0800

As discussed in the list, the packet to send the ticket may be
fragmented. When session resumption happened, a large number of the
client may try to present the ticket at the same time. In this case, a
bunch of fragmented IP packets will be sent to the gateway. Some
equipments (such as mobile network GW, firewalls, etc) between clients
and gateway may be overloaded to handle the IP fragment. And, some
equipments may treat it as DoS attack and simply drop all the
fragmented packets.

solution suggest: put the index mandatory, the full IKE sa ticket is
optional.
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: <[email-masked]>
Date: Tue, 18 Nov 2008 18:20:02 +0200

During the meeting I mentioned there's a paper explaining why 
keeping the first IKE_SA_INIT small (=small enough not to require
fragmentation) is useful. Tero found the link and posted it to Jabber:

    Kaufman, C., Perlman, R., and Sommerfeld, B., "DoS protection for
    UDP-based protocols", ACM Conference on Computer and
    Communications Security, October 2003.

Google found this PDF version:
http://www.eecis.udel.edu/~mills/teaching/eleg867b/dos/p2-kaufman.pdf

(However, currently the document allows the gateway to construct
tickets any way it wishes -- neither "ticket-by-reference" nor
"ticket-by-value" is mandatory. I think we should keep it this 
way -- but some parts of the draft probably need some clarification
how it works if "ticket-by-reference" is used.)

Best regards,
Pasi

> -----Original Message-----
> From:  Hui Deng
> Sent: 18 November, 2008 17:19
> To: [email-masked]
> Subject: [IPsec] draft-ietf-ipsecme-ikev2-resumption-00.txt fragmentation
> 
> 
> client may try to present the ticket at the same time. In this case,
> a bunch of fragmented IP packets will be sent to the gateway. Some
> equipments (such as mobile network GW, firewalls, etc) between
> clients and gateway may be overloaded to handle the IP
> fragment. And, some equipments may treat it as DoS attack and simply
> drop all the fragmented packets.
>

---

From: "Hui Deng" <[email-masked]>
Date: Wed, 19 Nov 2008 00:24:10 +0800

thanks Pasi and Tero pointing the document.

we will bring more text about how reference could work in this document.

-Hui

2008/11/19 <[email-masked]>