| |||||||||||||
Good SecurityGood SecurityPosted Apr 15, 2007 1:26 UTC (Sun) by mrash (guest, #44663)In reply to: Bad Security by ldo Parent article: Single Packet Authorization (Linux Journal)
So, can you suggest an attack vector against SPA? SPA is relatively simplistic (especially when only the symmtric Rijndael algorithm is used for encryption), depends on libpcap (which gets a lot of scrutiny), and fwknop is written in a buffer-safe language (perl).
The security benefit is that there is nothing a remote adversary can reasonably do to tell that fwknop is running, and arbitrary servers can be protected behind it using a kernel-level filtering mechanism (iptables) to fundamentally limit the number of user-space functions that an attacker would otherwise have access to.
(Log in to post comments)
|
|||||||||||||