The Deviation Attack: A Novel Denial-of-Service Attack Against IKEv2

In previous analyses IKEv2 has been shown to suffer from an authentication vulnerability that was considered not exploitable. By designing and implementing a novel slow Denial-of-Service attack, which we name the Deviation Attack, we show that the vulnerability is actually exploitable. We explain the attack's requirements, propose possible counter-measures and propose two possible modifications of the protocol, which both overcome the vulnerability.