Re: [Dots] Can DOTS protocol support IP whitelist for DOTS client's AA?

Hi there,

Current DOTS requirements draft goes to great lengths to protect a
DOTS connection from a passive attacker capturing packets on the way
from a client to a server and back (SEC-001, SEC-002, SEC-003,
DATA-002). One can come up with a handful of use cases where it's
important. Enabling a DOTS server to skip the certificate auth in
favour of the simple IP auth obviously violates this requirement.
Moreover, given recent ongoing research attempts on spoofing TCP
connections with either PRNG prediction or simple brute force ([1],
[2]) -- and yes, it's still rather easy to protect a network service
from such attacks, but it's currently not required from a DOTS server
to implement such protection -- I'd further say the IP auth sans
decent encryption is not suitable for a network service like that.

But of course that may be only me.

[1] http://lgms.nl/blog-7
[2] https://security.stackexchange.com/questions/107036/didnt-understood-what-the-purpose-of-the-newly-discovered-tcp-faking-attack

| Artyom Gavrichenkov
| gpg: 2deb 97b1 0a3c 151d b67f 1ee5 00e7 94bc 4d08 9191
| mailto: ximaera@gmail.com
| fb: ximaera
| telegram: xima_era
| skype: xima_era
| tel. no: +7 916 515 49 58

On Mon, Aug 7, 2017 at 3:52 AM, Xialiang (Frank)
<frank.xialiang@huawei.com> wrote:
> Hi,
>
> I think the direct use of IP whitelist on the DOTS server to authenticate
> and authorize the DOTS client is a simple and effect method, at least in
> some special use cases, like: DOTS client does not support certificate, an
> ISP which detects the spoofed source address, etc.
>
>
>
> So, should we support this as an optional way for the DOTS client’s AA and
> add it into the DOTS protocol drafts?
>
>
>
> B.R.
>
> Frank
>
>
> _______________________________________________
> Dots mailing list
> Dots@ietf.org
> https://www.ietf.org/mailman/listinfo/dots
>