Re: [secdir] Collision on changes for draft-ietf-soc-overload-control-14

["Vijay K. Gurbani" <[e-mail]>]

On 02/18/2014 03:55 PM, Spencer Dawkins wrote:
[...]
> This is working for me, but the version you and Joe crafted had "make it
> *more* difficult".
>
> I'm hoping not to say anything like "TCP is a great security strategy";
> "more difficult" is more like "TCP is a better security strategy than
> UDP, but ...".
>
> Could you help me understand where that word went?

Spencer: I had excised that word in a pique of editorial discretion
since I thought it was not qualifying anything substantive.  Clearly,
you thought otherwise, and that is perfectly fine.  I will reintroduce
it as follows (plus some minor edits to improve readability):

    Attacks that indicate false overload control are best mitigated by
    using TLS in conjunction with applying BCP 38 [RFC2827]. Attacks
    that are mounted to suppress genuine overload conditions can be
    similarly avoided by using TLS on the connection.  Generally, TCP or
    Websockets [RFC6455] in conjunction with BCP 38 makes it more
    difficult for an attacker to insert or modify messages, but may still
    prove inadequate against an adversary that controls links L1 and
    L2.  TLS provides the best protection from an attacker with access
    to the network links.

Thanks!

- vijay
-- 
Vijay K. Gurbani, Bell Laboratories, Alcatel-Lucent
1960 Lucent Lane, Rm. 9C-533, Naperville, Illinois 60563 (USA)
Email: vkg@{bell-labs.com,acm.org} / [e-mail]
Web: http://ect.bell-labs.com/who/vkg/  | Calendar: http://goo.gl/x3Ogq