port blocking (was Re: CELP (was RE:) )

[Tim Shepard <shep@alum.mit.edu>]

> As a side note, how is HIP going to allow port blocking? Will it avoid
> worm attacks by its puzzle mechanism. I don't think it is possible (but
> it can reduce its spawning speed.)


This is a very interesting question, and I expect there will never be a good
answer for this.  (The puzzle mechanism does not fundamentally help with
worm attacks, though it may help to defend against a DOS attack against
a specific server's CPU resources launched by a worm.)

How does IPSEC allow port blocking?  As far as I know, it does not.  After
the IKE exchange establishes a SA, ESP hides the TCP port numbers.
HIP has no better answer to this question than IPSEC, or any other protocol
that provides for encryption between strangers.

"Having an encrypted conversation with a stranger may be like meeting that
person in a dark alley.  Whatever happens, there are no witnesses."  (quote
is from Blumenthal and Clark, _Rethinking the Design of the Internet: The
End-to-End Arguments vs. the Brave New World, August 2001)



			-Tim Shepard
			 shep@alum.mit.edu