Re: [secdir] SecDir Review of draft-ietf-behave-dccp-03

Yes, that is much clearer.  Just one small thing:  from the wording it  
looks like it is the NAT that is letting the NAT
administrator reconfigure it.   I would instead have

To protect against denial-of-service attack filling its state storage
  capacity, a NAT
     may attempt to actively determine the liveliness of a DCCP
  connection, or  the NAT administrator could configure more  
conservative
  timeouts.

Cathy

Catherine Meadows
Naval Research Laboratory
Code 5543
4555 Overlook Ave., S.W.
Washington DC, 20375
phone: 202-767-3490
fax: 202-404-7942
email: catherine.meadows@nrl.navy.mil

On Oct 21, 2008, at 12:42 PM, Rémi Denis-Courmont wrote:

> 	Hello,
>
> Le mardi 21 octobre 2008 18:45:51 Catherine Meadows, vous avez écrit :
>>  I have reviewed this document as part of the security directorate's
>> ongoing effort to review all IETF documents being processed by the
>> IESG. These comments were written primarily for the benefit of the
>> security area directors.  Document editors and WG chairs should treat
>> these comments just like any other last call comments.
>>
>> This draft gives a set of behavioral requirements for network address
>> translation for DCCP.
>> In the secure considerations section, the authors discuss the
>> requirements that have security considerations,
>> and give recommendations.   This mostly looks in good shape, but I
>> have trouble understanding the discussion of
>> Requirement 5 in this section.  It reads, in its entirety:
>>
>>  REQ-5 recommends that a NAT that passively monitors DCCP state keep
>>    idle sessions alive for at least 124 minutes or 4 minutes  
>> depending
>>    on the state of the connection. it may attempt to actively  
>> determine
>>    the liveliness of a DCCP connection or let the NAT administrator
>>    configure more conservative timeouts.
>
> The text was supposed to be as follow, but the first proposition got  
> cut out
> during edition:
>
>  If a NAT is undergoing a denial-of-service attack,
>  it may attempt to actively determine the liveliness of a DCCP
>  connection or let the NAT administrator configure more conservative
>  timeouts.
>
>> It's unclear what the relationship is to security is here.  The
>> discussion needs to make that explicit.
>
> The wording comes from BEHAVE-TCP. I can hardly imagine the NAT  
> administrator
> rush to his NAT to reconfigure it, so this might be better... ?
>
>  To protect against denial-of-service attack filling its state storage
>  capacity, a NAT
>     may attempt to actively determine the liveliness of a DCCP
>  connection or let the NAT administrator configure more conservative
>  timeouts.
>
> Thanks for the review
>
> -- 
> Rémi Denis-Courmont
> http://git.remlab.net/cgi-bin/gitweb.cgi?p=vlc-courmisch.git;a=summary
>

_______________________________________________
secdir mailing list
secdir@ietf.org
https://www.ietf.org/mailman/listinfo/secdir