Re: [shara] port randomization (draft-ymbk-aplusp-03)

["Dan Wing" <[e-mail]>]

 

> -----Original Message-----
> From: [e-mail] [mailto:[e-mail]] 
> Sent: Wednesday, March 11, 2009 10:52 PM
> To: [e-mail]; [e-mail]
> Subject: RE: [shara] port randomization (draft-ymbk-aplusp-03)
> 
> 
> 
>   >-----Original Message-----
>   >From: [e-mail] 
> [mailto:[e-mail]] On Behalf Of
>   >ext Dan Wing
>   >Sent: Wednesday, March 11, 2009 5:46 PM
>   >To: [e-mail]
>   >Subject: [shara] port randomization (draft-ymbk-aplusp-03)
>   >
>   
> >http://tools.ietf.org/html/draft-ymbk-aplusp-03#section-4.8 says, in
>   >part:
>   >
>   >   ...
>   >   Port randomization is also a bit compromised in A+P 
> solution.  As CPE
>   >   can randomize ports only within port range that is 
> allocated to it,
>   >   randomness is more limited than in the the scenario 
> with full range
>   >   of ports, allowed for randomization.  We can assume, 
> that CPE either
>   >   gets port range from ephemeral range (49152-65535) or from
>   >   "registered ports" range (1024-49151).  Both ranges can 
> be used for
>   >   randomization, see [I-D.ietf-tsvwg-port-randomization] for more
>   >   details.
>   >
>   >Has consideration been given to having the PRR return only 
> *one* port
>   >for each request, or to returning a list of port numbers which are
>   >not consecutive and are not a bit-pattern of ports?  These 
> techniques
>   >would allow the PRR to distribute the requests randomly across the
>   >entire port range instead of within a block of ~100 (or whatever).
> 
> This is exactly the intention of section 4 and 5 in 
> http://www.ietf.org/internet-drafts/draft-bajko-pripaddrassign-01.txt
> 
> What section 5 describes is a way to communicate a list of 
> preallocated random ports to the client, in an indirect way.

Yes, but that list of random ports would not change until the user
said "I don't want this IP address anymore", perhaps.  What I am
suggesting is that the CPE could say "I don't want this port
anymore" and the CPE could exchange that port for a new random
port.

-d

>   >Further fleshing out of the technique described in Section 4.4
>   >("Dynamic allocation of port ranges") could be useful towards
>   >allowing applications to benefit from the security advantage of
>   >port randomization.
>   
> Yes, this is explicitely stated in section 2 of the above 
> mentioned draft.
> 
> - gabor
> 
>   >-d
>   >
>   >
>   >_______________________________________________
>   >shara mailing list
>   >[e-mail]
>   >https://www.ietf.org/mailman/listinfo/shara