Question: Guessing or knowing the initial TCP sequence number (ISN) that a server will choose enables an attacker to establish a TCP connection. Please discuss if

Guessing or knowing the initial TCP sequence number (ISN) that a server will choose enables an attacker to establish a TCP connection. Please discuss if the following solutions are secure (to prevent hijacking etc.) against off-path attackers and why. [x]32 denotes truncation of x to the 32 least significant bits. K is a (permanent) secret key stored locally and only known to the server. H represents a secure hash function (e.g., SHA256) and its algorithm is publicly known. Also note that || means concatenation and current timestamp is represented as UNIX timestamp. You can assume that 4 tuple information (source / destination IP and port) are known to the attacker. (1) Server selects ISN as ISN = [H(K)]32.

(2) Server computes ISN as follows: ISN = [H(source IP address XOR destination IP address XOR current timestamp XOR K)]32.

(3) Server computes ISN as ISN = [H(source IP address || destination IP address || source port number || destination port number || current timestamp)]32.

(4) Server selects ISN using a standard (i.e., publicly-known) pseudo random generator with K as a seed.

(5) Server selects ISN as ISN = [AES ECB(K, counter)]32, where the counter is continuous from the previous communication session.

Step by Step Solution

There are 3 Steps involved in it

1 Expert Approved Answer
Step: 1 Unlock blur-text-image
Question Has Been Solved by an Expert!

Get step-by-step solutions from verified subject matter experts

Step: 2 Unlock
Step: 3 Unlock

Students Have Also Explored These Related Databases Questions!