Subject: [multipathtcp] Attacker model for mptcp

From: Olivier Bonaventure <[email-masked]>
Date: Thu, 09 Dec 2010 20:14:01 +0100

Hello,

Based on the recent discussion, I think that we should assume the
following attackers to evaluate the security of multipath tcp :

Blind attacker

This attacker is able to send spoofed packets but cannot see any of the
packets exchanged by the hosts that he/she wants to attack

My view is that mptcp must be as secure as the current tcp when
considering this type of attacker

Passive listener and spoofable attacker

This attacker is able to listen to the packets exchanged over at least
one of the subflows but is not a router or a middlebox on the path
followed by the packets. This implies that the attacker is able to send
spoofed packets, but cannot modify the packets that are sent by any of
the communicating hosts. Furthermore, the attacker is not capable of
selectively discarding some of the packets sent by one of the hosts. The
attacker is able to cause a denial of service on one of the interfaces
used by the communicating hosts, but this denial of service is a blind
attack that affects all the packets exchanged over one of the interfaces
and not a selective attack where for example only the control packets
are discarded.

My view is that mptcp should be as secure as the current tcp when
considering this type of attacker.

I don't think that it is useful to consider attackers that are able to
modify the packets exchanged by the communicating hosts as such an
attacker is able to perform a man-in-the-middle attack against the two
hosts with tcp and mptcp should not protect against such attacks.

During private discussions last week, Mark Handley convinced me that it
not worthwhile to consider an attacker which is able to listen to
packets but cannot send spoofed packets as in practice the ability to
listen and spoof are usually combined.

Olivier

-- 
INL, ICTEAM, UCLouvain, Belgium, http://inl.info.ucl.ac.be