Re: Last Call: 'UDP Encapsulation of IPsec Packets' to Proposed Standard

[Tero Kivinen <kivinen@ssh.fi>]

Henrik Levkowetz writes:
> Ok, & thanks. I've not come across a NAT with less than a couple of
> minutes timeout myself, so I suspect this may be very atypical. I don't

I haven't seen those NATs myself either, but it might be because I
have only seen small NAT boxes in the office and home. I would assume
those big NAT boxes used by the ISP to NAT all traffic from all ADLS
lines from all of their customers might be using smaller timeouts.

> If they are described in some other RFC, fine, then refer to that. If
> not, I don't think you should put this mechanism out there without
> explicitly describing the attacks that this mechanism makes possible,
> which would not be possible otherwise. Sorry.

This mechanism does not make any new attacks possible for generic
hosts. I.e if the host is already listening any UDP socket then it is
vulnerable to the exactly same set of attacks. The difference is that
if this is IPsec SGW box that didn't do any UDP processing before
this, then this might open those attacks, because now it needs to do
more UDP processing than earlier. 
-- 
kivinen@ssh.fi
SSH Communications Security                  http://www.ssh.fi/
SSH IPSEC Toolkit                            http://www.ssh.fi/ipsec/