SHARE
SPREAD
HELP

The Tradition of Sharing

Help your friends and juniors by posting answers to the questions that you know. Also post questions that are not available.

To start with, Sr2Jr’s first step is to reduce the expenses related to education. To achieve this goal Sr2Jr organized the textbook’s question and answers. Sr2Jr is community based and need your support to fill the question and answers. The question and answers posted will be available free of cost to all.

The pleasure of all reading is doubled when one lives with another who shares the same. -Katherine Mansfield

 

#
Authors:
James F. Kurose, Keith W. Ross
Chapter:
Security In Computer Networks
Exercise:
Problems
Question:21 | ISBN:9780132856201 | Edition: 6

Question

Suppose Alice and Bob are communicating over an SSL session. Suppose an attacker, who does not have any of the shared keys, inserts a bogus TCP segment into a packet stream with correct TCP checksum and sequence numbers (and correct IP addresses and port numbers). Will SSL at the receiving side accept the bogus packet and pass the payload to the receiving application? Why or why not?

TextbookTextbookTextbookTextbookTextbookTextbookTextbookTextbookTextbookTextbookTextbookTextbookTextbookTextbookTextbookTextbookTextbook

Answer

No, SSL at the receiving side will not accept the bogus packet and pass the payload to the receiving application.

 

Explanation:

  • SSL (Secure Sockets Layer) provides secure communication by establishing a secure channel between the client (Alice) and the server (Bob) and encrypting the data transmitted over this channel.
  • SSL uses encryption and authentication mechanisms to ensure the integrity and confidentiality of the communication.
  • In the scenario described, the attacker is inserting a bogus TCP segment into the packet stream. Although the bogus segment has correct TCP checksum and sequence numbers, SSL operates at a higher layer in the protocol stack and has its own mechanisms to validate the integrity and authenticity of the communication.
  • When the receiving side (Bob) receives the bogus TCP segment, it will still need to pass the segment to the SSL layer for processing.
  • The SSL layer will perform a series of checks to ensure the integrity and authenticity of the packet, including verifying the SSL handshake, validating the certificates, and checking the MAC (Message Authentication Code) or digital signature of the received data.
  • Since the attacker does not have any of the shared keys necessary to generate the correct MAC or digital signature, the bogus packet will fail these checks.
  • As a result, the SSL layer will detect that the packet has been tampered with or is not authentic, and it will reject the packet. The payload of the bogus packet will not be passed to the receiving application because it fails the SSL validation process.

Hence, even if the attacker manages to forge a TCP segment with correct checksum and sequence numbers, SSL's higher-level mechanisms will prevent the acceptance of the bogus packet and ensure the security and integrity of the communication.

0 0

Discussions

Post the discussion to improve the above solution.