0

With IPsec transport mode we CAN'T have integrity of variable fields (eg TTL and checksum). Why is it a problem? Is it? What could be the attack?

I think TTL expire or checksum modification (so both DoS), but I mean, if an attacker can modify the TTL value or checksum, this means that he can literally also drop the packet. So... What's the point of this "vulnerability" in non-securing variable fields in IPsec transport mode?

Is there a particular scenario/vulnerability/attack that is different than DoS that can occur by modifying this varying field which can justify the need to have integrity also for these varying fields?

1 Answer 1

1

In transport mode, only the payload is encrypted. The header is suspect to manipulation unless the authentication header (AH) option is used. AH protects against manipulating the immutable fields and against option insertion.

As you've hinted, the TTL field changes along the path and the checksum with it, so these fields can never be protected unless you freeze the packet in tunnel mode.

If the encryption/integrity in transport mode is not sufficient, you can use tunnel mode which encrypts the entire original packet.

DoS is always an attack vector when an attacker can manipulate or drop packets, regardless of encryption or integrity checks. Or the other way around: protecting the headers doesn't provide DoS protection.

4
  • but you have not answered. my question was: is there a particular scenario/vulnerability/attack that is different than DoS that can occur by modifying this varying field which can justify the need to have integrity also for these varying fields?
    – allexj
    Commented May 17 at 12:14
  • is there a particular scenario... - normally not, but that depends on your security requirements actually. You have not told us anything about your use cases and potentially sensitive services.
    – Zac67
    Commented May 17 at 12:37
  • I don't have any usecase or services. I'm just a student with curiosity lol, so.... but what you mean for "normally not"? you mean there are some very particular situations for which I can have different attacks than DoS by editing these variable fields?
    – allexj
    Commented May 17 at 13:43
  • 1
    As a practical matter, transport mode is hardly ever used anymore (if it ever was). As a student, a good exercise would be to develop a scenario were you can create an attack by manipulating these unprotected fields.
    – Ron Trunk
    Commented May 17 at 17:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.