Re: [secdir] review of draft-ietf-6man-predictable-fragment-id-09
Fernando Gont <fgont@si6networks.com> Thu, 01 October 2015 22:36 UTC
Return-Path: <fgont@si6networks.com>
X-Original-To: secdir@ietfa.amsl.com
Delivered-To: secdir@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EDC091A8AF3; Thu, 1 Oct 2015 15:36:38 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.902
X-Spam-Level:
X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QHv30yTXRSpv; Thu, 1 Oct 2015 15:36:36 -0700 (PDT)
Received: from web01.jbserver.net (web01.jbserver.net [IPv6:2a00:8240:6:a::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 81A261A8AEF; Thu, 1 Oct 2015 15:36:36 -0700 (PDT)
Received: from [190.217.51.226] (helo=[172.30.6.28]) by web01.jbserver.net with esmtpsa (TLSv1.2:DHE-RSA-AES128-SHA:128) (Exim 4.85) (envelope-from <fgont@si6networks.com>) id 1ZhmSk-0005ko-JL; Fri, 02 Oct 2015 00:36:30 +0200
To: "Klaas Wierenga (kwiereng)" <kwiereng@cisco.com>
References: <4F5FD3E9-B5A3-4AAB-A089-61B674B59ECC@cisco.com> <55F010E9.2060606@si6networks.com> <9566C08E-D9B5-4C34-888D-F8D77335B5E3@cisco.com>
From: Fernando Gont <fgont@si6networks.com>
X-Enigmail-Draft-Status: N1110
Message-ID: <560DAAF0.9060708@si6networks.com>
Date: Thu, 01 Oct 2015 16:51:44 -0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0
MIME-Version: 1.0
In-Reply-To: <9566C08E-D9B5-4C34-888D-F8D77335B5E3@cisco.com>
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
Archived-At: <http://mailarchive.ietf.org/arch/msg/secdir/yZq2I1Ujryr2IcNeNxAsWfDPEIU>
Cc: "iesg@ietf.org" <iesg@ietf.org>, "draft-ietf-6man-predictable-fragment-id.all@tools.ietf.org" <draft-ietf-6man-predictable-fragment-id.all@tools.ietf.org>, "secdir@ietf.org" <secdir@ietf.org>
Subject: Re: [secdir] review of draft-ietf-6man-predictable-fragment-id-09
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/secdir/>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 01 Oct 2015 22:36:39 -0000
Hi, Klaas, On 09/09/2015 07:02 AM, Klaas Wierenga (kwiereng) wrote: >> On 09/09/2015 07:12 AM, Klaas Wierenga (kwiereng) wrote: >>> I believe the document has some issues, see below. >>> >>> The document does an analysis of the security implications of >>> predictable identification fields and I believe (not being an >>> IPv6 expert) that it does a good job at that. The analysis of >>> the potential exploits is convincing. Where I am struggling a bit >>> is the algorithms for selecting fragment identification values >>> (5). >>> >>> The intro text states that there are ‘a number of algorithms', >>> but really there are only 3: 1- per destination counter random >>> initialised 2- random value 3- hash over source, destination, >>> secret with a counter >> >> FWIW, these are three concrete algorithms, but that doesn't mean >> they are the only possible ones… > > Sure, I understand that. It is just when I read it I was preparing > for a long list to come, so I think it would be good to state > something like: > > OLD > > This section specifies a number of algorithms that may be used for > selecting Fragment Identification values. > > NEW > > There are a number of algorithms that may be used for selecting > Fragment Identification values. This section presents three of > those. Will do. (thanks for proposing a way forward, btw). >>> 1 and 3 are essentially the same, the hash function in 3 performs >>> the same function as the pseudo random generated initial value in >>> 1 if I am not mistaken. >> >> Yes and no. 1 requires state, but 3 doesn't. That means that, e.g., >> if you have lot's of flows to many different destinations, you may >> need to remove some entries from the Dest Cache (and then you run >> the risk of Frag ID collisions). However, this is not the case with >> algorithm #3. > > good point, so is there any compelling reason to select 1 over 3? It is generally the other way around: for #1, if you need to remove the state from the Destinations Cache, you run the risk of colliding Frag IDs. So you could say that #1 is more trivial to implement, whereas #3 has better properties (when there are ongoing communications with multiple destinations that make you hit the limit of entries in the Destination Cache). >>> So really the choice is between a random value for every datagram >>> or a random value at initialisation of a connection and >>> increasing by 1 for every subsequent datagram. >>> >>> I’d really like to see some quantitative analysis as to the >>> impact of a random value per packet as well as between 1 and 3. >> >> Impact in terms of what? > > Well, as an implementer I want to choose between one of the > algorithms you propose. But since I have no clue what the penalty is > for doing per packet randomisation as opposed to per flow that is > hard. Wel, the thing is that, to a large extent, it depends on the details of implementation. e.g., what's the algorithm you use for the randon() function, etc. > If the cost of a pseudorandom operation is outweighed by other > factors involved in sending a packet I would probably choose option > 2. My gut feeling says however that it is a pretty expensive > operation to do on a per packet basis, so I would expect the advise > to be “use 1 or 3” unless….. We tried to provide options rather than pushing one specific algorithm. > And similarly, what is the cost of the > hash versus the prg? If they are comparable would option 3 not be > better? It depends on which hash function vs PRG. For instance, you could employ a hash function for the PRG. So any assertion on performace would really be questionable... Thoughts? Thanks! Cheers, -- Fernando Gont SI6 Networks e-mail: fgont@si6networks.com PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492
- [secdir] review of draft-ietf-6man-predictable-fr… Klaas Wierenga (kwiereng)
- Re: [secdir] review of draft-ietf-6man-predictabl… Fernando Gont
- Re: [secdir] review of draft-ietf-6man-predictabl… Klaas Wierenga (kwiereng)
- Re: [secdir] review of draft-ietf-6man-predictabl… Fernando Gont
- [secdir] review of draft-ietf-6man-predictable-fr… Klaas Wierenga (kwiereng)