On Wed, 4 May 2011, George Bonser wrote:
SSM with encryption?
Well, certainly, but source address can be very easily spoofed with a UDP multicast stream. Now that could be mitigated with a lot of network configuration rules but something is needed that just works without all that.
It's harder to effectively use spoofed source addresses in multicasting because of RPF. When you couple it with SSM you're forcing the attacker to either use multiple injection points, or gain access to a router close to the real source address. Couple that with encryption and you're denying spoofed addresses as an effective intrusion venue for large groups of viewers listening to a specific SSM source. Perfect is the enemy of good. Antonio Querubin e-mail: tony@lavanauts.org xmpp: antonioquerubin@gmail.com