1

ESP in IPsec v2 only provides integrity of the payload, not of the header. So my question is about that. The possible dangers in not having integrity of header, while having ESP active for payload.

What are the potential risks if an attacker attempts to modify a packet header, given that there is no integrity check, but confidentiality of the payload is maintained? The attacker doesn’t possess the key, so even a minor alteration - such as changing a single bit - would drastically affect the decryption process at the destination, resulting in random data. So, what exactly is the threat or the potential for an attack here? I’m struggling to envision a plausible attack scenario.

The only attack I can think of is a Denial of Service (DoS), because the destination, after decryption, would be left with random data. However, this would be the case even if Authentication Header (AH) was used instead of Encapsulating Security Payload (ESP), and a DoS attack could occur regardless.

Are there any other scenarios that I might be overlooking?

4
  • ESP header isn't encrypted in transport mode, so your bit change example doesn't seem to apply either. Or were you thinking of tunnel mode?
    – schroeder
    Feb 15 at 16:54
  • @schroeder since my professor said "You could have ESP v2 without having AH so in that case you would have confidentiality but no integrity, but this is NOT a good thing so BEWARE"... so I don't have clear why should be so bad. what is the danger in that situation? I asked this question for this reason.
    – Allexj
    Feb 16 at 22:31
  • also, my professor said that "it's dangerous to apply esp v2 (so without doing integrity of header), because there are attacks that consists in changing header."... but what are they? I've thought about IP hijacking(but doesn't have sense) or IP spoofing(don't have clear what could be the attack in this scenario)... is there something I am not considering?
    – Allexj
    Feb 17 at 0:57
  • This sounds like a question to ask your prof to clarify. "Someone said this, is it right?" is always difficult to answer.
    – schroeder
    Feb 17 at 13:43

1 Answer 1

1

It's not true that flipping bits always garbles the resulting plaintext. In cipher-block-chaining (CBC) mode, manipulating one bit of the initialization vector leads to a corresponding one-bit change in the first plaintext block.

Without integrity checks, it can also be possible to decrypt the ciphertext through a padding-oracle attack. When data is encrypted with a block cipher like AES in CBC mode, then the plaintext has to be padded until its length is a multiple of the block size. This padding must have a certain pattern (e.g., the one defined in PKCS#7), so that in can be removed after decryption. A host which validates the padding but doesn't perform integrity checks (i.e., it accepts arbitrary ciphertext) will leak information about whether or not the padding of the decrypted ciphertext was valid. This allows an attacker to change individual bytes of the second-to-last ciphertext block, send the manipulated ciphertext to the host and check whether the manipulation resulted in a valid padding. If the padding is correct, the attacker can determine one byte of the last plaintext block according to the CBC scheme. Otherwise, they keep trying other bytes until the host indicates a valid padding. By repeating this procedure, the attacker decrypts the ciphertext byte-by-byte.

The padding-oracle attack has indeed been applied to encryption-only IPSec.

3
  • thanks for the answer, so the same can happen if a CTR-mode is being used. changing a bit in ctext will flip that bit in ptext, right?
    – Allexj
    Feb 17 at 0:31
  • CTR mode without integrity checks is indeed highly vulnerable to bit-flipping attacks.
    – Ja1024
    Feb 17 at 3:11
  • ok thanks, what about, if you may answer, about the other doubt? my professor said that "it's dangerous to apply esp v2 (so without doing integrity of header), because there are attacks that consists in changing header."... but what are they? I've thought about IP hijacking(but doesn't have sense) or IP spoofing(don't have clear what could be the attack in this scenario)... is there something I am not considering?
    – Allexj
    Feb 17 at 10:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .