NODE 8d598c0fRe: SSL search attack
droelke@rdxsunhost.aud.alcatel.com (Daniel R. Oelke)Fri, 1 Sep 95 05:27:47 PDT
>
> I see nothing wrong with the concept of being allocated an initial chunk
> and having the scan software attempt to ACK it when 50% of it has been
> searched. A successful ACK would allow the releasing of a new chunk (in
> response) equal in size to the returned chunk. A failure of the Server to
> accept the ACK would trigger a retry at set intervals (such as 75% and 100%
> or 60/70/80/90/100%) until the Server responds. Thus the scanner is always
> in possession of a Full Sized Chuck to scan (so long as the Server accepts
> an ACK before the 100% done mark) and temporary failures will not stop the
> process of a scanner as currently happens.
>
The only way this can work is if the server is told it is a 50%/75%/etc
size ACK, and then latter the server is ACKed for the full 100%.
Why? Because what happens if the client dies immediately after doing
the ACK - maybe only 51% of that space has been searched, yet
the server has already seen an ACK for it.
IMO - a % ACK is to much complexity and extra work on the server,
which is already having trouble keeping up.
Dan
------------------------------------------------------------------
Dan Oelke Alcatel Network Systems
droelke@aud.alcatel.com Richardson, TX
NODE 3fea5ea4Re: SSL search attack
Scott Brickner <sjb@austin.ibm.com>Fri, 1 Sep 95 09:57:15 PDT
Daniel R. Oelke writes
>The only way this can work is if the server is told it is a 50%/75%/etc
>size ACK, and then latter the server is ACKed for the full 100%.
>
>Why? Because what happens if the client dies immediately after doing
>the ACK - maybe only 51% of that space has been searched, yet
>the server has already seen an ACK for it.
>
>IMO - a % ACK is to much complexity and extra work on the server,
>which is already having trouble keeping up.
I agree. ACKing partial segments is a bad idea. But, when a client
is given a block of segments, partial ACKing can let poorly connected
clients communicate with the server via e-mail, and still stay busy.
When the client completely finishes half of its segments, it ACKs them
and asks for that many more segments. The fraction can be adjusted as
mean communications latency to the server is measured. Ideally the
new segments arrive just as the client finishes the second half of its
original segments. This way the segments are allocated as late as
possible, letting better connected clients have a better shot at them.