Subject: RE: KINK user-user scenario

From: "Medvinsky, Sasha (SD-EX)" <[email-masked]>
Date: Wed, 24 Jan 2001 20:20:50 -0500

Derek,

In the PacketCable case the client (MTA) doesn't have an option to not rekey
with a particular server (CMS).  There is a MIB table that tells the MTA
with which CMS it should establish IPSec SAs.  The WakeUp mechanism in
PacketCable is used either for error recovery (e.g. when the server reboots)
or when the same "clustered" server with the same name is switching from one
IP address to another.  But when it is switching only between IP addresses,
the client would reuse the same ticket and not talk to the KDC.  The client
is basically required to maintain tickets for any server that it knows
about.

In the general case outside of PacketCable - I already agreed with you that
the extra handshake would be useful to protect the KDC against this type of
DOS.  I was just clarifying that the DOS is on the KDC - not the application
server.

Sasha.

> -----Original Message-----
> From: Derek Atkins [mailto:[email-masked]]
> Sent: Wednesday, January 24, 2001 5:12 PM
> To: Medvinsky, Sasha (SD-EX)
> Cc: Michael Thomas; Jonathan Trostle; [email-masked]
> Subject: Re: KINK user-user scenario
> 
> 
> "Medvinsky, Sasha (SD-EX)" <[email-masked]> writes:
> 
> > [sasha] This is not a big problem if you have a 'server 
> cookie' in the
> > initiate and then again in the AP Request - the real server 
> would ignore any
> > AP Requests that it didn't initiate. I suppose the DOS to 
> the server is just
> > the fact that it is receiving these packets from a client 
> and has to process
> > them at all.  But in that case, the extra handshake doesn't 
> eliminate this
> > problem - anyone can still send an 'Initiate' to a client 
> with some server's
> > IP address and a client has to respond (just with a 
> different message).
> > Just for that reason, rate limiting would be useful in general.
> 
> This doesn't protect the KDC.  An attacker could send a request for a
> bunch of servers and cause the client to go off the KDC and expend a
> lot of energy.  In the packetcable case, an attacker could basically
> force all the clients to 'rekey' to all the "known" CMSes, all at
> once!  The extra handshake _does_ eliminate this problem, because no
> real work would be done (except sending messages) until both sides
> actually agree that work should be done.
> 
> -derek
> 
> -- 
>        Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory
>        Member, MIT Student Information Processing Board  (SIPB)
>        URL: http://web.mit.edu/warlord/    PP-ASEL-IA     N1NWH
>        [email-masked]                        PGP key available
>