RFC4081 - Security Threats for Next Steps in Signaling (NSIS)

   An adversary might inject a bogus reply message, forcing the
   discovery message initiator to start a messaging association
   establishment with either an adversary or with another NSIS node that
   is not along the path.  Figure 3 describes the attack in more detail
   for peer-to-peer addressed messages with a discovery mechanism.  For
   end-to-end addressed messages, the attack is also applicable,
   particularly if the adversary is located along the path and able to
   intercept the discovery message that traverses the adversary.  The
   man-in-the-middle adversary might redirect to another legitimate NSIS
   node.  A malicious NSIS node can be detected with the corresponding
   security mechanisms, but a legitimate NSIS node that is not the next
   NSIS node along the path cannot be detected without topology
   knowledge.

                      +-----------+   Messaging Association
     Message           Adversary    Establishment
     Association +--->+           +<----------------+
     Establish-      +----+------+                 (4)
      ment            IPx                        
              (3)         Discovery Reply         v
                           (IPx)              +---+-------+

上一页 [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] [17] [18] [19] [20] [21] [22] [23] [24] [25] [26] [27] [28] [29] [30] [31] [32] [33] [34] [35] [36] [37] [38] 下一页

复制本页网址和标题，发送给你QQ/Msn的好友一起分享

上一篇:RFC4085 - Embedding Globally-Routable Internet Addresses Considered Harmful

下一篇:RFC4103 - RTP Payload for Text Conversation