Re: [secdir] Collision on changes for draft-ietf-soc-overload-control-14

[Spencer Dawkins <[e-mail]>]

On 02/19/2014 10:19 AM, Vijay K. Gurbani wrote:
> On 02/18/2014 03:55 PM, Spencer Dawkins wrote:
> [...]
>> This is working for me, but the version you and Joe crafted had "make it
>> *more* difficult".
>>
>> I'm hoping not to say anything like "TCP is a great security strategy";
>> "more difficult" is more like "TCP is a better security strategy than
>> UDP, but ...".
>>
>> Could you help me understand where that word went?
>
> Spencer: I had excised that word in a pique of editorial discretion
> since I thought it was not qualifying anything substantive. Clearly,
> you thought otherwise, and that is perfectly fine.  I will reintroduce
> it as follows (plus some minor edits to improve readability):
>
>    Attacks that indicate false overload control are best mitigated by
>    using TLS in conjunction with applying BCP 38 [RFC2827]. Attacks
>    that are mounted to suppress genuine overload conditions can be
>    similarly avoided by using TLS on the connection.  Generally, TCP or
>    Websockets [RFC6455] in conjunction with BCP 38 makes it more
>    difficult for an attacker to insert or modify messages, but may still
>    prove inadequate against an adversary that controls links L1 and
>    L2.  TLS provides the best protection from an attacker with access
>    to the network links.
>
> Thanks!
>
> - vijay

Works for me!

Spencer