Unit 01 of 03
Protocol Security
Counting the claims network protocols accept without verification: the claim distribution per layer, the claims an open port is ready to accept, the corrupted records in address and name resolution caches, rogue address assignment, denial of service measured by capacity arithmetic, on-path attacks as an evidence-chain gap, and replay and spoofing measured in terms of freshness proof.
Published Updated
Lessons
- 01 Layer Models and Attack Surface Measuring the network surface in claims: a single meter reading carrying 18 claims across four layers with none of them having proof, five defenses making 11 claims verifiable while leaving 7 open, a defense being unable to see any claim of the layer beneath it, and verification costing 4 extra round trips, 13 key items, 25 manual items, 11 rejected connections, and 6 devices left out. 13 min read
- 02 Common Ports and Services Measuring open services in claims: 20 services opening 49 accept points across 6 hosts, 21 accept points resting on no proof at all, 4 externally reachable services receiving not one legitimate request in 30 days, closing unused services and narrowing access cutting accept points to 27 while breaking 4 periodic flows, and verifying the last 7 accept points excluding 240 devices. 13 min read
- 03 Address Resolution Attacks Measuring how the address resolution cache is corrupted by an unverified reply: 6 of 18 records corrupted in a set of 26 replies, a pinned record rescuing 4 and leaving 2, a consistency check rescuing 5 and leaving the single most valuable record, accepting only the requested reply rescuing all six while cutting 3 legitimate announcements, and the three defenses together rejecting 4 legitimate replies and never forming 2 records at all. 14 min read
- 04 Name Resolution Attacks Measuring how the name resolution cache is corrupted by an unverified reply: 7 of 16 names corrupted, misdirecting 38 of 73 dependent services; signed verification rescuing 3 records and leaving 4 in an unsigned zone; an expired signature making 2 names fully unresolvable and stopping 9 services; strict mode zeroing out corrupted records while stopping 47 services; and a lifetime cap cutting corrupted-record duration by 88.1% while raising query count by 346.5%. 13 min read
- 05 Address Assignment Risks Measuring address assignment in claims: 14 endpoints accepting 70 claims without verification at 5 claims per reply, the first-reply-wins rule binding 7 endpoints to a source with no proof, port trust zeroing out misconfiguration while leaving 2 endpoints unconfigured, and pool inspection combined with static assignment correctly configuring the same 12 endpoints with 3 manual items while leaving 2 endpoints misconfigured. 13 min read
- 06 Denial of Service Attacks Measuring denial of service through capacity arithmetic: the same 4,000 req/s load producing the same result across four different source distributions, a 4,096-slot state table filling in 1.02 seconds, a per-source rate limit cutting the load to 5 on a single source while changing nothing at 4,000 sources, handshake proof ending slot exhaustion without ever lowering the request rate, and load shedding cutting legitimate traffic to 22%. 14 min read
- 07 On-Path Attacks Measuring an on-path attack as a missing chain of evidence: 3 of 8 flows having no chain at all across 36 hops and 16 of those hops being able to read the content, the number of parties that could produce the identity claim being 272, endpoint verification raising that number to 509, root pinning lowering it to 11, and the single flow carrying 89,400 requests staying chainless because it cannot verify. 13 min read
- 08 Replay and Spoofing Attacks Measuring replay and spoofing in terms of freshness proof: 10 message types accepting a replay as is with no freshness proof, the counter fully protecting 75% of the volume without covering even a single state-changing type, the timestamp staying open for a 120-second window, the nonce with a separate store staying open by 2 recipients, and 36,460 requests still being repeatable without limit even with all three proofs on. 13 min read