Re: [secdir] SecDir Review of draft-ietf-behave-dccp-03

	Hello,

Le mardi 21 octobre 2008 18:45:51 Catherine Meadows, vous avez écrit :
>   I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the
> IESG. These comments were written primarily for the benefit of the
> security area directors.  Document editors and WG chairs should treat
> these comments just like any other last call comments.
>
> This draft gives a set of behavioral requirements for network address
> translation for DCCP.
> In the secure considerations section, the authors discuss the
> requirements that have security considerations,
> and give recommendations.   This mostly looks in good shape, but I
> have trouble understanding the discussion of
> Requirement 5 in this section.  It reads, in its entirety:
>
>   REQ-5 recommends that a NAT that passively monitors DCCP state keep
>     idle sessions alive for at least 124 minutes or 4 minutes depending
>     on the state of the connection. it may attempt to actively determine
>     the liveliness of a DCCP connection or let the NAT administrator
>     configure more conservative timeouts.

The text was supposed to be as follow, but the first proposition got cut out 
during edition:

  If a NAT is undergoing a denial-of-service attack,
  it may attempt to actively determine the liveliness of a DCCP
  connection or let the NAT administrator configure more conservative
  timeouts.

> It's unclear what the relationship is to security is here.  The
> discussion needs to make that explicit.

The wording comes from BEHAVE-TCP. I can hardly imagine the NAT administrator 
rush to his NAT to reconfigure it, so this might be better... ?

  To protect against denial-of-service attack filling its state storage
  capacity, a NAT
     may attempt to actively determine the liveliness of a DCCP
  connection or let the NAT administrator configure more conservative
  timeouts.

Thanks for the review

-- 
Rémi Denis-Courmont
http://git.remlab.net/cgi-bin/gitweb.cgi?p=vlc-courmisch.git;a=summary
_______________________________________________
secdir mailing list
secdir@ietf.org
https://www.ietf.org/mailman/listinfo/secdir