Re: [conex] Stephen Farrell's No Objection on draft-ietf-conex-tcp-modifications-09: (with COMMENT)

[Mirja Kühlewind <[e-mail]>]

Hi Stephan,

quick reply to you comment below. The two points below are discussed in 
draft-ietf-conex-destopt as ConEx is signaled in the IP layer and the attacks 
would (from my point of view) only interfere with the signaling (and not any 
additional algorithms that are used in TCP to decide when to set a marking).

draft-ietf-conex-destopt even has an own section on "Mitigating flooding 
attacks by using preferential drop". I guess that's what you've been looking 
for, right?

Further, draft-ietf-conex-destopt says in the security section that IPsec AH 
can be used to detect changes to ConEx information. Actually it does not say 
what to do if such changes are detected. I'll check with my co-authors if we 
can add some more information here.

Regarding draft-ietf-conex-tcp-modifications, I've added two sentences at the 
beginning of the security section to say that these issues are discussed in 
draft-ietf-conex-destopt. Is that okay for you?

Mirja



On 01.10.2015 13:56, Stephen Farrell wrote:
> Stephen Farrell has entered the following ballot position for
> draft-ietf-conex-tcp-modifications-09: No Objection
>
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
>
>
> Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
> for more information about IESG DISCUSS and COMMENT positions.
>
>
> The document, along with other ballot positions, can be found here:
> https://datatracker.ietf.org/doc/draft-ietf-conex-tcp-modifications/
>
>
>
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
>
>
> Seems like a fine thing to experiment with. I hope the results
> are interesting.
>
> The security considerations really ought take into account or at
> least mention potential misbehaviour by middleboxes and also how
> conex might be affected by DoS attacks.
>