Subject: [Tsvwg] Re: Random Tags ?

From: "Randall R. Stewart" <[email-masked]>
Date: Tue, 27 Mar 2001 07:41:40 -0600

"Gayraud, Richard" wrote:
> 
> Hi all,
> 
> The SCTP specification says that the tag should be randomized
> to protect against "man in the middle" and "sequence number"
> attacks (see section 5.3.1 in RFC 2960).
> 
> I can't figure out a scenario where a randomized tag gives a higher
> security level against attacks. Could someone provide an example
> (or a link onto an existing document) please ?
> 
> Thanks a lot,
> 
> Richard.
> 

Random tags protects you in the same way has TCP random sequence
numbers.

If I am a blind attacker, I cannot see anything going on
between you and your peer. But I can make some educated
guesses. For instance If I know about when you
setup your association. I can setup an association myself (just
prior to you setting up an association) and I now have from
you a sequence number and a V-Tag (your intial ones you want
from me). Now if you are doing a NON-Random or a easily construed
random thing (such as using the time and a port number), I can
pretty much know within a small number what the next V-Tag
is that you have choosen. Thus I can send an ABORT with the
correctly guessed tag. Or I can worse, inject a packet that
you did not send into the association.

Now the reference implementation did a BAD job with random
numbers up until Steve Belovin and I had a conversation at
the 50th IETF.... The next release for BSD and Linux stains
(and any other that has a /dev/random) will use good
random numbers. For those O/S's that don't support /dev/random
it will still use the easy to guess initial tag and sequence
number...

R

-- 
Randall R. Stewart
[email-masked] or [email-masked]
815-342-5222 (cell) 815-477-2127 (work)

_______________________________________________
tsvwg mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/tsvwg