Re: [shara] port randomization (draft-ymbk-aplusp-03)

[<[e-mail]>]

  >-----Original Message-----
  >From: [e-mail] [mailto:[e-mail]] On Behalf Of
  >ext Dan Wing
  >Sent: Wednesday, March 11, 2009 5:46 PM
  >To: [e-mail]
  >Subject: [shara] port randomization (draft-ymbk-aplusp-03)
  >
  >http://tools.ietf.org/html/draft-ymbk-aplusp-03#section-4.8 says, in
  >part:
  >
  >   ...
  >   Port randomization is also a bit compromised in A+P solution.  As CPE
  >   can randomize ports only within port range that is allocated to it,
  >   randomness is more limited than in the the scenario with full range
  >   of ports, allowed for randomization.  We can assume, that CPE either
  >   gets port range from ephemeral range (49152-65535) or from
  >   "registered ports" range (1024-49151).  Both ranges can be used for
  >   randomization, see [I-D.ietf-tsvwg-port-randomization] for more
  >   details.
  >
  >Has consideration been given to having the PRR return only *one* port
  >for each request, or to returning a list of port numbers which are
  >not consecutive and are not a bit-pattern of ports?  These techniques
  >would allow the PRR to distribute the requests randomly across the
  >entire port range instead of within a block of ~100 (or whatever).

This is exactly the intention of section 4 and 5 in http://www.ietf.org/internet-drafts/draft-bajko-pripaddrassign-01.txt

What section 5 describes is a way to communicate a list of preallocated random ports to the client, in an indirect way.


  >Further fleshing out of the technique described in Section 4.4
  >("Dynamic allocation of port ranges") could be useful towards
  >allowing applications to benefit from the security advantage of
  >port randomization.
  
Yes, this is explicitely stated in section 2 of the above mentioned draft.

- gabor

  >-d
  >
  >
  >_______________________________________________
  >shara mailing list
  >[e-mail]
  >https://www.ietf.org/mailman/listinfo/shara