Subject: [P2PSIP] A possible attack scenario for P2PSIP ?

From: Tien Tuan Anh Dinh <[email-masked]>
Date: Mon, 01 Jun 2009 17:34:29 +0100

Hi all,

I've just finished reading the draft
http://www.ietf.org/internet-drafts/draft-irtf-p2prg-rtc-security-01.txt

It occurs to me that the following attack scenario might be possible:

1. Client A registers its location, storing a tuple of the form <id_a, 
location_a, expiredtime> to a peer P in the DHT overlay (P also 
represents all replica nodes storing the key id_a)

2. Client B searches for A's location, as a result contacts P.

3. P decides to not give B the latest A's location. It either sends a 
out-of-date tuple regarding A's location or says that A is not in the 
network. A has no way to know or enforce P to behave properly.

It is a variation of the Denial of Service attack, in which the client A 
could be made completely unreachable to the other clients.

Assume the authenticity and integrity of all the tuples, would you say 
that this is a probable attack? My main concern is what incentives of P 
in doing this, especially in this P2P-SIP setting. I think this attack 
depends on the incentives model that encourages clients to act as peers 
in the DHT overlay. I would love to hear some reasonable explanation of 
why P would (and would not) engage in this attack.

Looking forwards to hear your comments.

Anh.

---

From: "David A. Bryan" <[email-masked]>
Date: Wed, 3 Jun 2009 00:11:48 -0400

This particular type of attack has been looked at before in several of
the proposed protocol drafts and discussed in some of the security
documents in this WG, so you can find a bit more there. You are
correct, however, that it is a bit of a different attack from those
common in client server approaches.

In the literature, there are several ways to protect against it,
including signed registrations with expirations to prevent spoofed or
expired registrations from being returned, and registration
replication to protect against P simply saying there is no
registration (I can ask someone else if I get a negative response to
get a second opinion if the party really is in the system)

David

On Mon, Jun 1, 2009 at 12:34 PM, Tien Tuan Anh Dinh
<[email-masked]> wrote:
> location_a, expiredtime> to a peer P in the DHT overlay (P also represents
> all replica nodes storing the key id_a)
>
> Assume the authenticity and integrity of all the tuples, would you say that
> this is a probable attack? My main concern is what incentives of P in doing
> this, especially in this P2P-SIP setting. I think this attack depends on the
> incentives model that encourages clients to act as peers in the DHT overlay.
> I would love to hear some reasonable explanation of why P would (and would
> not) engage in this attack.
>
> _______________________________________________
> P2PSIP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/p2psip
>

---

From: "David A. Bryan" <[email-masked]>
Date: Wed, 3 Jun 2009 11:46:41 -0400

As I mentioned, the signer must include an expiration. There is of
course a window where they could update (change) a registration, and
so there could be a time where a hostile node has two valid, unexpired
registrations at his disposal to choose from, and could return a false
one. This is a reason why registrations (including the expiration
time) must be signed, and why they should be short duration.

If an attacker controls all replicas, you do have a problem,
obviously, but forget the replicas, if the attacker can control that
much of an overlay, they likely can simply prevent routing. Again,
this is a classic attack on P2P systems, and rate-limiting new
identities is designed to protect against this. If you are assuming
that the attacker can somehow directly compromise and control either a
large portion (so that it includes all replicas) or targeted (peer and
it's replicas), again, at that point the attacker could simply take
over the overlay (or just take over A). In such a case, you are out of
luck, but with that assumption, so is any client server architecture
(i.e., if I can take over the server, I control the network)

This isn't a new attack, it has been considered extensively in the
literature and in this group, and while there are some risks
(peer-to-peer networks have different attack vectors), such an attack
would be difficult to mount in practice with the sort of security safe
guards that are being discussed in the WG.

Thanks,

David

On Wed, Jun 3, 2009 at 7:49 AM, Tien Tuan Anh Dinh
<[email-masked]> wrote:
>> expired registrations from being returned,
>
> In the scenario I proposed, I assume the authenticity & integrity of these
> registrations, which include expired date as well. So there's no worry of
> spoofing.
>
> I also assumed that the attacker can control all the replicas that store the
> particular registration. That could be a reasonable assumption given  a
> powerful attacker.
>
> The main issue here is not that client B (searching for client A) doesn't
> get the answer from P, but instead it always gets the expired registration
> from P, even A just "renewed" its registration a P. Thus, my question still
> is: are there reasonable incentives for P to do that ?
>
> Anh.
>