Spoofing Packets

• An attacker can spoof packets

  • Keystream knew for some IV
  • The IV is sent in clear, so is available to the attacker as well.
  • Since the integrity check does not depend on a key, but just on the message M, now an attacker can now spoof packets

Notes: