Re: [conex] Stephen Farrell's No Objection on draft-ietf-conex-destopt-09: (with COMMENT)

[Stephen Farrell <[e-mail]>]

Hi Bob,

Those all sound like pretty good changes except perhaps for...

On 01/10/15 23:06, Bob Briscoe wrote:
> 
> 
> [Proposed]
> A network-based attacker could alter ConEx information to fool an audit
> function in a downstream network into discarding packets. An attack on
> one network from another by changing an immutable field can be traced,
> so it would be unlikely givennetwork operators care about their
> reputation.

If the attack is carried out by a compromised node then the goals
of the rightful owner of that node aren't relevant.

> Nonetheless, if ConEx information was being altered within a
> network, IPsec AH or other more stealthy e2e integrity checks could be
> useful tools to help pin-point the attack location.

I'd omit "more stealthy" unless you want to add a reference. (I
guess that'd be to your Phd thesis and why not include that.)

Cheers,
S.