Posted Apr 15, 2007 1:26 UTC (Sun) by mrash
In reply to: Bad Security
Parent article: Single Packet Authorization (Linux Journal)
So, can you suggest an attack vector against SPA? SPA is relatively simplistic (especially when only the symmtric Rijndael algorithm is used for encryption), depends on libpcap (which gets a lot of scrutiny), and fwknop is written in a buffer-safe language (perl).
The security benefit is that there is nothing a remote adversary can reasonably do to tell that fwknop is running, and arbitrary servers can be protected behind it using a kernel-level filtering mechanism (iptables) to fundamentally limit the number of user-space functions that an attacker would otherwise have access to.
to post comments)