[conex] draft-ietf-conex-destopt

[Bob Briscoe <[e-mail]>]

Mirja, Suresh,

I promised (offlist) that I would post the following suggested text 
to the list for the Security Considerations of conex-destopt. This 
would replace the current single sentence that simply says "This 
document does not bring up any new security issues." which doesn't 
sound very reassuring.

HTH



Bob

========================================================================================
[abstract-mech] describes the overall audit framework for assuring 
that ConEx markings truly reflect actual path congestion. This 
section focuses purely on the security of the encoding chosen for 
ConEx markings.

The chg bit in the CDO option type field is set to zero, meaning that 
the CDO option is immutable. If IPsec AH is used, a zero chg bit 
causes AH to cover the CDO option so that its end-to-end integrity 
can be verified, as explained in Section 4.

It has been specified that the Reserved field in the CDO must be 
ignored and forwarded unchanged even if it does not contain all 
zeroes. The Reserved field is also required to sit outside the 
encrypting security payload (ESP), at least in transport mode (see 
Section 7). This seems to allow the sender to use the Reserved field 
as a 28-bit-per-packet covert channel to send information to an 
on-path node outside the control of IPsec. However, a covert channel 
is only a concern if it can circumvent IPsec in tunnel mode and, in 
the tunnel mode case, ESP would close the covert channel as outlined 
in Section 7.
========================================================================================


________________________________________________________________
Bob Briscoe,                                                  BT