From owner-freebsd-arch Wed Jul 18 15:43:11 2001 Delivered-To: freebsd-arch@freebsd.org Received: from smtp.med.und.nodak.edu (smtp.med.und.NoDak.edu [134.129.166.20]) by hub.freebsd.org (Postfix) with ESMTP id A08E737B403 for ; Wed, 18 Jul 2001 15:43:09 -0700 (PDT) (envelope-from bpederson@geocities.com) Received: from geo.med.und.nodak.edu ([134.129.166.11] helo=geocities.com) by smtp.med.und.nodak.edu with esmtp (SSLv3:RC4-MD5:128) (Exim 3.20 #1) id 15MzzZ-000G3d-00 for freebsd-arch@freebsd.org; Wed, 18 Jul 2001 17:40:29 -0500 Message-ID: <3B561053.6370CEE8@geocities.com> Date: Wed, 18 Jul 2001 17:40:19 -0500 From: Barry Pederson X-Mailer: Mozilla 4.77 [en] (Windows NT 5.0; U) X-Accept-Language: en MIME-Version: 1.0 To: freebsd-arch@freebsd.org Subject: Re: TCP Initial Sequence Numbers: We need to talk References: <001101c10fcc$7a7927f0$a586fa18@chris> <20010718160345.J74461@prism.flugsvamp.com> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-freebsd-arch@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG Jonathan Lemon wrote: > > Its not feasible; he's overlooking several things. Among them > are: 1. it is susceptible to replay attacks, 2. the secret is > per IP, and 3. "having the response go nowhere" is not a valid > defense, if the attacker can guess it. 1, 2. It's protecting against spoofed SYN floods, the replay attack would have to be a non-spoofed ACK flood (since the attacker could probably figure out their own token) --or-- the attacker was also sniffing your network, could see what was in the outgoing SYN/ACK packets at least once for each spoofed IP, and then flooded with spoofed ACKs containing the encrypted token for that particular spoofed address. 3. He's assuming that guessing a 256-bit encryption key would be pretty tough, which probably would be, even if your machine uptime is many years so the key doesn't change for a long long time :) I kind of wonder though if the tiny amount of data being encrypted would somehow make a cipher easier to crack. Barry To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-arch" in the body of the message