Subject: Re: [IPsec] Cost-efficient quantum-resistant DoS protection

From: "Valery Smyslov" <[email-masked]>
Date: Mon, 1 Nov 2021 14:07:56 +0300

Hi Michael,

> Tero Kivinen <[email-masked]> wrote:
>     >> Even without surpassing the 64KB limit, this must be a concern.
>     >> IKEv2's cookie mechanism and puzzles try to increase the cost of the
>     >> attacker per each connection. Now, an attacker must still accept
>     >> these costs but can use one connection to trigger several key
>     >> exchanges, all significantly larger than what we had with DH, making
>     >> the trade-off way better for them compared to non-pqc IKEv2.
> 
>     > No it cannot. Attacker can use cookie only once, and will only get one
>     > exchange created by each cookie exchange, thus it needs to do puzzles
>     > and cookies again for every single attack packet it wants to send.
> 
> I wonder if anyone has any stats on how often cookie challenge is used, how
> often puzzles are invoked.

I've implemented puzzles, but I'm not aware of any other implementation.

What about cookies - in stress tests they are used very intensively.
But I don't have any real life stats for them.

Regards,
Valery.

>     > So I do not think DoS attack properties of the IKEv2 is at all
>     > modified with addition to the multiple ke, or beyond 64k limit drafts.
> 
> I agree.
> 
> IKEv2 is not SSLv3.
> 
> --
> Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
>            Sandelman Software Works Inc, Ottawa and Worldwide
> 
> 
>

---

From: Yoav Nir <[email-masked]>
Date: Mon, 8 Nov 2021 11:54:18 +0200

> On 1 Nov 2021, at 13:07, Valery Smyslov <[email-masked]> wrote:
> 
> Hi Michael,
> 

I also implemented puzzles. So that makes two of us.

Yoav

---

From: Michael Richardson <[email-masked]>
Date: Wed, 10 Nov 2021 09:41:28 -0500

> I also implemented puzzles. So that makes two of us.

Did you ever interop?

What is your criteria for enabling them?  Do you do this automatically, or is
it an operator configuation to demand them?

---

From: "Valery Smyslov" <[email-masked]>
Date: Fri, 12 Nov 2021 09:56:40 +0300

Hi Michael,

>     > I also implemented puzzles. So that makes two of us.

We didn't try, but I think we can do it eventually.

> it an operator configuation to demand them?

I can only speak for my code. There is a configuration option, that  controls the using puzzles. You have the following options:
- turn them off
- always use them in both IKE_SA_INIT and IKE_AUTH when cookie is requested 
  (which happens if the number of half-open SAs exceeds some configurable threshold)
- always use them, but only in IKE_SA_INIT, when cookie is requested
- use them only when cookie is requested and some other conditions are met 
   (e.g. you may set a higher threshold for puzzles, than for cookies)

You can also set a difficulty of puzzles. It is statically configured.
>From my experiments there is a really small interval of complexity when puzzles
are useful (so that they do require noticeable efforts from initiators and still are solved
within reasonable time, e.g. a few seconds). From my recollection
it is between 16-18 bits of complexity.

Regards,
Valery.

---

From: Yoav Nir <[email-masked]>
Date: Fri, 12 Nov 2021 09:05:53 +0200

> On 10 Nov 2021, at 16:41, Michael Richardson <[email-masked]> wrote:
> 
> 

No. Never got to it.

> it an operator configuation to demand them?

GUI had three settings: off, cookies, puzzles.  In case of cookies or puzzles, they would activate with a certain number of simultaneous IKE negotiations in progress.

Because of GUI constraints, that setting had to apply to both IKEv1 and IKEv2 (that was s separate set of radio buttons)

Yoav

---

From: Michael Richardson <[email-masked]>
Date: Fri, 12 Nov 2021 17:56:36 -0500

Thank you for the summaries.