Subject: RE: Cookie generation in SCTP

From: <[email-masked]>
Date: Wed, 19 Feb 2003 20:06:33 +0200

Hi Dirk!

	See my comments inline...

> Dear all,
> 
> I have some questions about SCTP cookies.
> 
> Is it possible to get a detailed description about how a 
> cookie for SCTP 
> looks like or an example cookie to get a feeling how to 
> implement one ?
> 
> All we found in the standard is that some steps SHOULD be taken to 
> generate the State Cookie but there is no actual format described.
> 
> It is my guts feeling, that the actual format of the cookie 
> parameter is 
> implementation depended. Or is there a common format that has been 
> agreed upon (hashing function, etc)?

	You are right... RFC 2960 shows some guidelines about how the cookie should be constructed. However, as it is the sender of the cookie itself the only one that should pay attention to this field (upon receipt of the COOKIE ECHO), its design is completely up to the sender...

	You can use any hash function you want to generate it. You can even generate a dummy cookie, or you don't even have to check it if you don't want. But, of course, the more care you put in the construction and verification of the cookie, the more strong against attacks your implementation will be.

	I use what it is stated in the RFC, and I guess that most of us do the same.

> If yes, are there already any implementations or existing 
> java classes 
> which provides cookie generation ?

	I don't know about this, but for sure there will be some C functions available in the open source implementations.

	BR Iván Arias Rodríguez

> Thanks in advance for your answers
> 
> Nice regards
> Dirk
> 
>

---

From: "Randall Stewart (cisco)" <[email-masked]>
Date: Wed, 19 Feb 2003 13:31:40 -0600

A comment or two inline :>

>	I use what it is stated in the RFC, and I guess that most of us do the same.

Yeah, I think most of us are either using MD5 or SHA-1. I use SHA-1
by default for my signature.. a bit stronger but more CPU required :-0
thats why a compile switch can have it use MD5 :->

It is very very un-wise to not have some sort of hash in the cookie.. 
not saying
you can't do it this way.. especially if you are worried about a DOS attack
against your CPU... This is why we tried to be vague here... It depends on
what threat you are most worried about... memory or CPU...

>	I don't know about this, but for sure there will be some C functions available in the open source implementations.
You can find an example of the SHA-1 type cookie generation
in the BSD code inside the kame software
http://www.kame.net

In particular in sctp_output.c of this code you will find a
"sctp_add_cookie()" function. This will call the fnc
sctp_hash_disgest_m()

which builds the signature over the cookie based on
the compile switch MD5 or SHA-1

I am sure you can also find in the lksctp version a hashing
algorithm as well..

Hope that helps...

-- 
Randall R. Stewart
ITD
Cisco Systems Inc.
[email-masked] 815-342-5222(cell) or 815-477-2127(office)

---

From: Jon Grimm <[email-masked]>
Date: Wed, 19 Feb 2003 15:13:24 -0600

> I am sure you can also find in the lksctp version a hashing

Yep, lksctp use SHA-1 (the hash code has its heritage in Randy's 
user-level impl. IIRC).  A warning..our COOKIE is pretty huge & has lots 
of redundant fields.  So as a counter-plug, Randy and Qiaobing's book 
goes into interesting tidbits to put in one's cookie and why one would 
need them.

Best Regards,
Jon Grimm

---

From: Randall Stewart <[email-masked]>
Date: Wed, 19 Feb 2003 15:30:16 -0600

> goes into interesting tidbits to put in one's cookie and why one would 
Thanks for the plug :> And I think one would find the kame
implementation and the book have about the same cookie
stuff as described .. (not that I am saying not to
buy the book mind you :>) we may be a bit bigger (we have
a bunch of scoping stuff we also put in) but in general
we have smaller than  200 byte (or so) cookies...

R

-- 
Randall R. Stewart
[email-masked] 815-342-5222 (cell phone)