Subject: Re: Re: bidding down attach on NAT-T

From: Jayant Shukla <[email-masked]>
Date: Wed, 5 Mar 2003 10:57:14 -0800 (PST)

-------Original Message-------
From: Michael Richardson <[email-masked]>
    Charlie> there is nothing we could possibly do within IKE or ESP to
    Charlie> improve the situation.

  The thing that we could do, is require some kind of three way handshake
to
change the UDP port #/IP address. That could be a rekey.

We had this discussion a few days ago. This is the exact method we are using in our NAT traversal. However, this method too is not perfect as an attacker can falsly convince you to keep doing three-way handshakes. Not a big problem, and can be solved by rate limiting the three-way handshakes, but an annoynace none the less.

Regards,
Jayant
www.trlokom.com

---

From: Michael Richardson <[email-masked]>
Date: Wed, 05 Mar 2003 18:47:35 -0500

-----BEGIN PGP SIGNED MESSAGE-----

>>>>> "Jayant" == Jayant Shukla <[email-masked]> writes:
    mcr> The thing that we could do, is require some kind of three way
    mcr> handshake to change the UDP port #/IP address. That could be a
    mcr> rekey.

    Jayant> We had this discussion a few days ago. This is the exact method
    Jayant> we are using in our NAT traversal. However, this method too is
    Jayant> not perfect as an attacker can falsly convince you to keep doing
    Jayant> three-way handshakes. Not a big problem, and can be solved by

  As I said in another message, if you include this as part of the dead-peer
detection, then it should work fine. The trick is not doing both at the same
time. I haven't looked at all at the DPD stuff, so I don't know.
  The other thing is making sure that the client can somehow become aware
that something may be trying to spoof it.

]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] [email-masked] http://www.sandelman.ottawa.on.ca/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [