Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

On a very high level, its known that SSL/TLS uses message digests to verify the integrity of the messages sent. However, the question I have in mind is : How does SSL ensure a DoS does not happen based on integrity verification ?

Consider this scenario where a handshake is taking place between a server and a client. These are all network packets that ARE going through the network as un-intelligble data. If there are message digests for every record, what would happen if an attacker kept changing one bit of every packet that passes through him (this is definitely possible right? )? Wouldn't that effectively lead to a DoS since the integrity check has failed, which would lead to the communication being stopped ?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

Yes, this is possible. When the digest comes back as incorrect, the SSL implementation should drop the connection.

However, the attacker would need to be in a man-in-the-middle position, so he could equally just drop all traffic, or send TCP FIN / RST packets to close the connection itself.

share|improve this answer
1  
Yeah, but I believe this would be a more subtle attack fooling the user to think there is a problem only with that particular server. Also, it may lead the user to try a 'http' connection, following which, the attacker could gain a lot of information –  sudhacker Sep 11 '12 at 16:35
    
Not really. The FIN/RST injection would do the same job. –  Polynomial Sep 11 '12 at 19:59

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.