Re: [secdir] Secdir review of draft-ietf-tsvwg-port-randomization-06.txt

[Lars Eggert <[e-mail]>]

Hi,

On 2010-3-4, at 5:09, Fernando Gont wrote:
>> when you make some of the text changes that Charlie suggested, please
>> make them in a way that doesn't break what the document says about
>> [Allman]. (Mark Allman ran some tests with some of the algorithms in
>> this document, and if we change their description retroactively, it
>> may affect what we can say about his effort.)
> 
> I don't think the resulting changes would affect the results in
> [Allman]. For instance, I'd bet the random() function he used provided
> 32-bit pseudo-random numbers (rathern than 16-bit numbers, as previously
> suggested in the I-D).

please check with Mark on this. I believe you are right, but it's better to be sure than to bet.

>>>> The document is titled "Transport Protocol Port Randomization 
>>>> Recommendations", but it doesn't really make recommendations. It 
>>>> enumerates current practice and calls out the pros and cons, but
>>>> it doesn't really recommend what an implementer should do. That's
>>>> probably OK, but it seemed a bit odd.
>> 
>> this came up during the WG discussion. If I remember correctly, the
>> document is the way it is because the WG felt that multiple schemes
>> work well, and because this is not something that requires
>> interoperability, there was no strong need to pick a "winner".
> 
> I didn't apply any change in response to this. (Just for the record, *I*
> would have been happier with the document recommending a particular
> algorithm... but I do see the point of why the wg didn't think so).

I would have been happier, too, but I think the argument was that we didn't want to needlessly say that some existing implementations don't comply to the recommendations in the RFC when it doesn't matter because their algorithm is good enough.

Lars