[secdir] secdir review of draft-ietf-mptcp-attacks-02

[Phillip Hallam-Baker <[e-mail]>]

I have reviewed this document as part of the security directorate's ongoing
effort to review all IETF documents being processed by the IESG.  These
comments were written primarily for the benefit of the security area
directors.  Document editors and WG chairs should treat these comments just
like any other last call comments.


Top level: this is a core security document and requires detailed review by
the security area ADs.

Given the time constraints and the fact that this is a document describing
security options for an experimental protocol, I have not considered the
attacks or possible solutions in detail yet.

One general point is that the security model should explain what is
considered to be a security failure with a little more precision. Since
this is a transport layer protocol that does transport, end-to-end
confidentiality and integrity protections are more properly considered in
an above transport/below application layer protocol such as TLS.

The attacks that would be very damaging to multipath are attacks that
disrupt the channel in ways that the end-to-end component can't recover
from.


Some nits:


General,

HMAC is frequently used where MAC is the correct term of art. HMAC is one
construction of a MAC based on a hash function. This is quite likely not
the optimum technique for a protocol at this layer where AES acceleration
hardware is usually available and SHA-2/3 hardware is not. Moreover the MAC
approaches are much more efficient even in software as they can be streamed.

Section 1:

   o  Off-path attacker.  This is an attacker that does not need to be
      located in any of the paths of the MPTCP session at any point in
      time during the lifetime of the MPTCP session.  This means that
      the Off-path attacker cannot eavesdrop any of the packets of the
      MPTCP session.


Having singled out the type of attacks that can't be made, the attacks that
can should be mentioned as well. Or better still, state that the attacks
are limited to active attacks.

Since the attack classification is referenced in the attacker
classification, better to describe the attacks first.