Date: Wed, 18 Jul 2001 17:40:19 -0500 From: Barry Pederson <bpederson@geocities.com> To: freebsd-arch@freebsd.org Subject: Re: TCP Initial Sequence Numbers: We need to talk Message-ID: <3B561053.6370CEE8@geocities.com> References: <001101c10fcc$7a7927f0$a586fa18@chris> <20010718160345.J74461@prism.flugsvamp.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Jonathan Lemon wrote: > > Its not feasible; he's overlooking several things. Among them > are: 1. it is susceptible to replay attacks, 2. the secret is > per IP, and 3. "having the response go nowhere" is not a valid > defense, if the attacker can guess it. 1, 2. It's protecting against spoofed SYN floods, the replay attack would have to be a non-spoofed ACK flood (since the attacker could probably figure out their own token) --or-- the attacker was also sniffing your network, could see what was in the outgoing SYN/ACK packets at least once for each spoofed IP, and then flooded with spoofed ACKs containing the encrypted token for that particular spoofed address. 3. He's assuming that guessing a 256-bit encryption key would be pretty tough, which probably would be, even if your machine uptime is many years so the key doesn't change for a long long time :) I kind of wonder though if the tiny amount of data being encrypted would somehow make a cipher easier to crack. Barry To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-arch" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3B561053.6370CEE8>