3

On a very high level, its known that SSL/TLS uses message digests to verify the integrity of the messages sent. However, the question I have in mind is : How does SSL ensure a DoS does not happen based on integrity verification ?

Consider this scenario where a handshake is taking place between a server and a client. These are all network packets that ARE going through the network as un-intelligble data. If there are message digests for every record, what would happen if an attacker kept changing one bit of every packet that passes through him (this is definitely possible right? )? Wouldn't that effectively lead to a DoS since the integrity check has failed, which would lead to the communication being stopped ?

Improve this question

1 Answer 1

Reset to default
3

Yes, this is possible. When the digest comes back as incorrect, the SSL implementation should drop the connection.

However, the attacker would need to be in a man-in-the-middle position, so he could equally just drop all traffic, or send TCP FIN / RST packets to close the connection itself.

Improve this answer
2
  • 1
    Yeah, but I believe this would be a more subtle attack fooling the user to think there is a problem only with that particular server. Also, it may lead the user to try a 'http' connection, following which, the attacker could gain a lot of information
    – sudhacker
    Sep 11, 2012 at 16:35
  • 1
    Not really. The FIN/RST injection would do the same job.
    – Polynomial
    Sep 11, 2012 at 19:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .