Anoop V A (anova) writes: > If we are sending the extra IKE responder life time notification in > MM6 or AM2 - since the peer AUTHENTICATION data is also available > in these messages - can we overcome this situation. We can avoid > attack by changing the life time only if the authentication is > successful.
As I pointed out earlier, attacker can MODIFY the notification data, so they can change the life time stored inside the notification data (there are some difficulties there, but lets not go to them). On the other hand you would never accept any lifetime that would not be accordingly to your own policy anyways, so this attack isn't that effective in this case, as attacker can only change lifetime to something that you would otherwise accept. So in worst case you are in the same situation you were without this notification. > I understand may be other implementation will avoid this extra > notify - but is there any violation in sending this extra notify in > these messages? Most likely they will ignore the extra notify, but to be safe it might be better to add vendor id payloads and only send notify if the other end is sending known vendor id. There are some quite bad IKEv1 implementations out there, and I would not even try to guess what they might do when they get extra notification payloads. -- [email protected] _______________________________________________ IPsec mailing list [email protected] https://www.ietf.org/mailman/listinfo/ipsec
