I am studying for an exam in computer security, and I got stuck on the following question from a past exam:
A random program generator service S allows clients to generate random data. Each client Ci shares a symmetric key Ki with the service. The system implements the following protocol:
In order to ask for random data, a client Ci sends the UDP message IPi, IPS, X, L to S, where IPi is the IP of the client and IPS is the IP of the server, X = E(IPi, Ki) is the encryption of IPi using key Ki, and L is the number of byte requested
The service checks that D(X, Ki) = IPi and terminates if the check fails
If the check succeeds, the service generates L bytes of random data, splits the results in blocks of 512 KB, and sends each block Dj to the client via a UDP message IPS, IPi , Dj to Ci
Describe how this system can be abused by an attacker (that is not one of the clients) in order to perform a DOS of one of the clients Ci. Assume that the attacker has less bandwidth than the victim and that they cannot recover the key Ki even if they can analyze the traffic.
So far I am thinking that in order to DOS a client we have to somehow make S send out data to this client. However, since we do not have the key Ki, I cannot really see how we could ever make S send out any data. Some guidance here would really be appreciated.