Re: [conex] Stephen Farrell's No Objection on draft-ietf-conex-destopt-09: (with COMMENT)

Stephen Farrell <stephen.farrell@cs.tcd.ie> Fri, 02 October 2015 08:52 UTC

Return-Path: <stephen.farrell@cs.tcd.ie>
X-Original-To: conex@ietfa.amsl.com
Delivered-To: conex@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4BAE21ACED7; Fri, 2 Oct 2015 01:52:56 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.311
X-Spam-Level:
X-Spam-Status: No, score=-4.311 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1BO9NBa0RdNU; Fri, 2 Oct 2015 01:52:53 -0700 (PDT)
Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7A4081ACED6; Fri, 2 Oct 2015 01:52:53 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 4620ABE39; Fri, 2 Oct 2015 09:52:52 +0100 (IST)
X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie
Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9TqIAxfdX3ck; Fri, 2 Oct 2015 09:52:51 +0100 (IST)
Received: from [10.87.48.73] (unknown [86.46.22.228]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 63781BDD0; Fri, 2 Oct 2015 09:52:50 +0100 (IST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1443775971; bh=aqeWW8u29KKwyrqD/ZaqEcyuPVumMXBp6Ul/X+Vt6Js=; h=Subject:To:References:Cc:From:Date:In-Reply-To:From; b=jEZYiCkbcs+qxh4NtN49CGA8Iirgj/Y+mCgzagEeCKqjq23+38JYFaCMPKJZpLkIZ Yh+Qtoe+llK774nhnU5x32YumYwLUJdmq92BWD2hzbe8MiAAu4OP7YvfLBsuPyDbyd BxrZyOrpMEruy8gizmbJodHD1mdohj4c5RoN++Eg=
To: Bob Briscoe <ietf@bobbriscoe.net>, Suresh Krishnan <suresh.krishnan@ericsson.com>
References: <20151001000655.11590.32411.idtracker@ietfa.amsl.com> <E87B771635882B4BA20096B589152EF63A97724C@eusaamb107.ericsson.se> <560CEF4E.5080409@cs.tcd.ie> <560DAE68.60401@bobbriscoe.net>
From: Stephen Farrell <stephen.farrell@cs.tcd.ie>
Openpgp: id=D66EA7906F0B897FB2E97D582F3C8736805F8DA2; url=
Message-ID: <560E45E2.2040809@cs.tcd.ie>
Date: Fri, 2 Oct 2015 09:52:50 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0
MIME-Version: 1.0
In-Reply-To: <560DAE68.60401@bobbriscoe.net>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Archived-At: <http://mailarchive.ietf.org/arch/msg/conex/0Sdu_NSrtF1cwksCHFPFXOrMjv8>
Cc: "draft-ietf-conex-destopt.ad@ietf.org" <draft-ietf-conex-destopt.ad@ietf.org>, "conex-chairs@ietf.org" <conex-chairs@ietf.org>, The IESG <iesg@ietf.org>, "conex@ietf.org" <conex@ietf.org>, "draft-ietf-conex-destopt@ietf.org" <draft-ietf-conex-destopt@ietf.org>
Subject: Re: [conex] Stephen Farrell's No Objection on draft-ietf-conex-destopt-09: (with COMMENT)
X-BeenThere: conex@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Congestion Exposure working group discussion list <conex.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/conex>, <mailto:conex-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/conex/>
List-Post: <mailto:conex@ietf.org>
List-Help: <mailto:conex-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/conex>, <mailto:conex-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 02 Oct 2015 08:52:56 -0000

Hi Bob,

Those all sound like pretty good changes except perhaps for...

On 01/10/15 23:06, Bob Briscoe wrote:
> 
> 
> [Proposed]
> A network-based attacker could alter ConEx information to fool an audit
> function in a downstream network into discarding packets. An attack on
> one network from another by changing an immutable field can be traced,
> so it would be unlikely givennetwork operators care about their
> reputation.

If the attack is carried out by a compromised node then the goals
of the rightful owner of that node aren't relevant.

> Nonetheless, if ConEx information was being altered within a
> network, IPsec AH or other more stealthy e2e integrity checks could be
> useful tools to help pin-point the attack location.

I'd omit "more stealthy" unless you want to add a reference. (I
guess that'd be to your Phd thesis and why not include that.)

Cheers,
S.