Subject: Re: comments on draft-ietf-ipv6-privacy-addrs-v2-00.txt

From: Suresh Krishnan <[email-masked]>
Date: Fri, 22 Oct 2004 11:04:44 -0400 (EDT)

Hi Bill,
  Can you give me more details or a pointer to such an attack? I will add 
add some text and a reference to it.

Thanks
Suresh

On Fri, 22 Oct 2004, BIll Sommerfeld wrote:

>On Fri, 2004-10-22 at 00:05, Suresh Krishnan wrote:
>> I would agree with you that a an attacker can extrapolate a lot about the 
>> data, using packet sizes and timing. But do you feel that the size of the 
>> packets and the timing can be used to correlate the IDENTITY of the victim? 
>
>Yes.
>
>

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: BIll Sommerfeld <[email-masked]>
Date: Fri, 22 Oct 2004 11:47:04 -0400

> add some text and a reference to it.

There's a wealth of information about traffic analysis capabilities in
many books about WW-II-era codebreaking. 

As a more modern example:

By observing the timing and size of a sequence of packets in and out of
a system acting as a traditional SMTP mail relay, one can most likely
identify probable SMTP flows (3-way handshake of tinygrams, SMTP banner,
HELO, MAIL FROM, one or more RCPT TO, DATA+message, QUIT, tcp
termination tinygrams).

This gives you message size, recipient count, and length of each email
address in the envelope.

You can now correlate messages in with messages out (message out will be
larger by the typical size of a received: header), and may let you
identify messages and possible replies in 1:1 email conversations by
matching the sender and recipient address lengths...

With sufficient data you could also probably also pick out behavioral
quirks such as which correspondents habitually fail to trim quoted
material in replied-to messages.

You may also want to reference the new traffic-flow-security extensions
(extended padding, dummy traffic discards) in the current drafts of
IPsec ESP.

					- Bill