Date: Fri, 1 Dec 2000 13:40:21 -0800 From: "John Howie" <JHowie@msn.com> To: "Ralph Huntington" <rjh@mohawk.net>, "David G. Andersen" <dga@pobox.com> Cc: "Brett Glass" <brett@lariat.org>, "Umesh Krishnaswamy" <umesh@juniper.net>, <freebsd-security@FreeBSD.ORG> Subject: Re: Defeating SYN flood attacks Message-ID: <00a101c05bdf$4e6e9b00$fd01a8c0@pacbell.net> References: <200012012100.OAA05277@faith.cs.utah.edu>
next in thread | previous in thread | raw e-mail | index | archive | help
"David G. Andersen" wrote: > Lo and behold, Ralph Huntington once said: > > > > This is very very clever. I don't see any holes in it (anyone else?). > > It needs more peer review. In particular: There are flaws in the implementation: I don not believe that on a heavily used site encryption would not slow the system down (somewhat), especially a heavily used system. By maintaining a cache, as suggested, you are still consuming resources so a DoS can still occur. Given that you know the plaintext (the Client IP Address), the cipher text (SISN - CISN) and the algorithm, you can work out the key used (eventually). If the key is only changed at system startup, the longer the system is running, the more likely it will be that the key is computed. We all talk about how long our boxes are up and running for (compared to NT/2000) and we usually talk in months, if not years. The key needs to be changed more often - perhaps hourly (which still might not be enough). You could improve security by combining the CISN with some (server-specific) value which would allow a unique key to be created for each incoming connection. You would need to store state (the key) and that consumes resources so we are back to where we were (DoS). Spoofers can still cause you a problem. If the spoofer is on the return route to the spoofed IP addressed host then they will still see the sequence. This proposed system, IMHO, is flawed. john... To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?00a101c05bdf$4e6e9b00$fd01a8c0>