Re: [EXTERNAL] Re: Transmission of IPv6 Jumbograms as Atomic Fragments

On Sat, 20 Nov 2021, 03:18 Templin (US), Fred L, <Fred.L.Templin@boeing.com>
wrote:

> I am sorry Mark, but this is not AH – the AERO/OMNI identification
> mechanism
>
> is modeled after the way TCP peers negotiate sequence number windows, with
>
> the expectation that the peers may renegotiate sequence numbers frequently
> to
>
> keep the attack surface unpredictable. Please do not make blanket
> statements
>
> without reading documents.
>

Did you look up the AH spec? See section 2.5 Sequence Number.

As I said before, your description of replay protection is describing one
of the features of AH.

If you add that functionality to Jumbogram EHs, you are reinventing it
needlessly.

Combine AH EH with JG EH and you've got your jumbo packets with replay
protection.

You're not inventing anything new. The functionality to protect against
packet replaying already exists in AH (and ESP).

Regards,
Mark.

>
> Fred
>
>
>
> *From:* Mark Smith [mailto:markzzzsmith@gmail.com]
> *Sent:* Friday, November 19, 2021 7:53 AM
> *To:* Templin (US), Fred L <Fred.L.Templin@boeing.com>
> *Cc:* Nick Hilliard <nick@foobar.org>; IPv6 List <ipv6@ietf.org>
> *Subject:* [EXTERNAL] Re: Transmission of IPv6 Jumbograms as Atomic
> Fragments
>
>
>
> EXT email: be mindful of links/attachments.
>
>
>
>
>
>
> On Sat, 20 Nov 2021, 02:32 Templin (US), Fred L, <
> Fred.L.Templin@boeing.com> wrote:
>
> Thanks Mark, but I don’t want AH; I want AERO/OMNI. I want the
> Identifications to serve
>
> the dual purpose of supporting the fragmentation/reassembly process and
> providing an
>
> in-window value that recipients can use to detect spurious packets. And, I
> want the same
>
> mechanism used for packets of all sizes, up to and including jumbos.
>
>
>
> AH + JG
>
>
>
> Done. No reinventing wheels.
>
>
>
>
>
> Fred
>
>
>
> *From:* Mark Smith [mailto:markzzzsmith@gmail.com]
> *Sent:* Thursday, November 18, 2021 4:11 PM
> *To:* Templin (US), Fred L <Fred.L.Templin@boeing.com>
> *Cc:* Nick Hilliard <nick@foobar.org>; IPv6 List <ipv6@ietf.org>
> *Subject:* Re: Transmission of IPv6 Jumbograms as Atomic Fragments
>
>
>
> On Fri, 19 Nov 2021, 07:12 Templin (US), Fred L, <
> Fred.L.Templin@boeing.com> wrote:
>
> Nick,
>
> > Do you have a use case in mind for the ID field?
>
> Thank you for this timely question. I just got done posting a major update
> to the
> draft, which now is titled: "IPv6 Packet Identification" and considers all
> forms of
> IPv6 packets and not just Jumbograms. In answer to your question here is
> the new
> Section 2 text from the draft (link provided below):
>
> "2.  IPv6 Packet Identification
>
>    When IPv6 sources and destinations have some way of maintaining
>    "windows" of acceptable Identification values, the destination may be
>    able to examine received packet Identifications to determine whether
>    they likely originated from the source.
>
>
>
> This seems to be describing the sequence number verification used in IPsec
> AH per RFC 4302.
>
>
>
> It may be worth either just using AH as is, and getting all of its other
> benefits, or look at creating a simplified version of it rather than
> modifying the jumbogram EH to start duplicating existing AH functionality.
>
>
>
> According to RFC 4302 there are a range of reserved SPI values (1 through
> 255), you could use one of those to indicate a light weight version of AH
> that just does packet identification, avoiding the need to set up Security
> Associations with IKE.
>
>
>
> Regards,
>
> Mark.
>
>
>
> The AERO
>    [I-D.templin-6man-aero] and OMNI [I-D.templin-6man-omni]
>    specifications discuss methods for maintaining windows of
>    unpredictable values that may reduce attack profiles in some
>    environments."
>
> Thanks, and here is the draft URL:
>
> https://datatracker.ietf.org/doc/draft-templin-6man-jumbofrag/
>
> Fred
>
> > -----Original Message-----
> > From: Nick Hilliard [mailto:nick@foobar.org]
> > Sent: Thursday, November 18, 2021 9:16 AM
> > To: Templin (US), Fred L <Fred.L.Templin@boeing.com>
> > Cc: IPv6 List <ipv6@ietf.org>
> > Subject: Re: Transmission of IPv6 Jumbograms as Atomic Fragments
> >
> >
> > Templin (US), Fred L wrote on 18/11/2021 15:23:
> > > Bob, what I want is exactly the Identification field that is found in
> the Fragment Header
> > > while simply leaving the rest of the fields of that header set to 0
> >
> > Do you have a use case in mind for the ID field?
> >
> > Nick
>
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> ipv6@ietf.org
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------
>
>