[shara] draft-thaler-port-restricted-ip-issues: Security Considerations

[<[e-mail]>]

Dear Dave, all,

You wrote in the draft: "One mitigation for security attacks against TCP is port randomization
   [I-D.ietf-tsvwg-port-randomization].  Reducing the port space
   available to host thus reduces its ability to randomize ports, and
   hence has negative security implications.  This issue would be made
   worse if there were any port sub-delegation (where sub-ranges are
   allocated out of larger ranges), since each hierarchy level would
   introduce some wasted ports."

Your statement is true for small contiguous port ranges. Nevertheless, it is more complicated to guess the port number when using ** non-contiguous ** port ranges (e.g., assign 64 contiguous port ranges using the same Port Range Mask to a given device, http://tools.ietf.org/html/draft-bajko-pripaddrassign-02#section-4.1) or with pre-allocated random port numbers as defined in http://tools.ietf.org/html/draft-bajko-pripaddrassign-02#section-5.  

More information can also be found at: http://www.ietf.org/proceedings/74/slides/shara-1/shara-1_files/v3_document.htm.

BTW, it is more complex to guess the TCP sequence number than the ports. Isn't sufficient to randomize the SN to mitigate issues listed in I-D.ietf-tsvwg-port-randomization? 

Cheers,
Med
*********************************
This message and any attachments (the "message") are confidential and intended solely for the addressees. 
Any unauthorised use or dissemination is prohibited.
Messages are susceptible to alteration. 
France Telecom Group shall not be liable for the message if altered, changed or falsified.
If you are not the intended addressee of this message, please cancel it immediately and inform the sender.
********************************