AY2.ORG

It has taken a few days, but the IPsec vulnerability story has found ts way to the mainstream news sites, including:

• The Register UK.gov warns over VPN crypto flaw
• ZDNet UK Government warns of IPsec VPN flaw
• Slashdot Flaw Found in VPN Crypto Security

Some observers quite correctly note that it has been known for a long time that encryption without authentication (on which the attacks are based) is a bad idea, so these attacks aren’t new. Well, the point is encryption-only configuration of IPsec is still allowed in the current ESP standard (RFC 2406) and the forthcoming standard (ESPv3 Internet Draft), and these new attacks show that encryption without authentication is as good as no encryption. so you might as well not bother. The attacks are highly efficient, and allow recovery of arbitrary encrypted ESP encrypted IP datagrams in full. In addition, the attacks have been implemented and demonstrated to work under realistic conditions. This is in contrast to Bellovin’s previous work Problem Areas for the IP Security Protocols, which is a fine piece of work outlining the importance of integrity protection, but of more a theoretical nature. The attacks presented in that paper required some rather unrealistic assumptions, and were relatively cumbersome and of low impact.

In summary, these attacks are new and significant, but the actual flaw is well understood, but the fix is not mandated by the IPsec standard .