Subject: Re: [Isis-wg] ISIS Cryptographic Authentication - Replay attacks

From: Jeff Learman <[email-masked]>
Date: Mon, 15 Apr 2002 10:50:04 -0400

Very interesting.

The "good news" about these flaws is that they can be mounted only by
a directly connected system, and the attacked system would act as
a firewall protecting the rest of the network, making them much
less serious than an LSP replay attack.

Regards,
Jeff

At 05:47 AM 4/15/2002, Jonnala, Nagi wrote:
>Tony/Atkinson,
>
>I have a few comments on ISIS Cryptographic Authentication mechanism
>in the context of Replay Attacks. Sorry for the inconvenience if it was
>already discussed.
>
>Though the Draft says "This mechanism does not prevent replay attacks, 
>however such attacks would trigger existing mechanisms in the IS-IS protocol
>that would effectively reject old information.", My interpretation is that
>we 
>do not have any mechanism protecting from replay attacks of LSP-Sequence-0, 
>Hellos, CSNPs and PSNPs".
>
>Here is the description.
>
>1) LSP with Sequence Number 0 
>=============================
>
>ISO 10589 specifies that we use this special LSP to request the latest LSP
>from the intended recipient. It can be replayed as many times as the
>intruder wants. The generation/processing of that LSP may not be triggered
>by this attack...But I believe the real threat is  "Intruder
>can capture all the LSP-Sequence-0 packets and can replay again and again to
>consume the resources."  The lack of Key-ID mechanism even worsens the
>situation because a cryptographic LSP-Sequence-0 packet may not be changed
>very often.
>
>2) CSNPs,  PSNPs  replay
>========================
>
>The worst situation in this case is when intruder
>replays a particular xSNP packet which could cause a huge
>transmittals of LSPs.  One can replay the same packet repeatedly
>to consume the maximum resources and perhaps network
>will never seem to stabilize.
>
>3) Hello PDUs replay-back
>=========================
>
>As Jerome Etienne points out in "OSPFv2 authentication flaws" Internet
>Draft,  Hello PDUs
>can be replayed back by MAC address spoofing(Please correct me if MAC
>address spoofing is not possible) to break the adjacency.
>
>Please correct me if I wrongly interpreted anything.
>
>Thanks
>Nagi.
>
>_______________________________________________
>Isis-wg mailing list  -  [email-masked]
>http://spider.juniper.net/mailman/listinfo/isis-wg

_______________________________________________
Isis-wg mailing list  -  [email-masked]
http://spider.juniper.net/mailman/listinfo/isis-wg