Re: [Softwires] Comments on draft-dec-stateless-4v6-02

[Nejc Škoberne <[e-mail]>]

Dear Wojciech,

> - If one believes that port unrestriced TCP provides "enough" security, 
> then the port-restriction does little to alter that in consideration of 
> host/CPE practices (no randomization). As you point out, such "belief" 
> may be misplaced, especially with larger widow sizes. Granted, a system 
> with full random source port selection across the full port range is ideal.

My point was, that this "little" is not as little as some people might
think. This is what I tried to show with my calculation. I still think
the difference is significant in practice and that using port-restricted
systems without any measures (like random port selection in
draft-bajko-pripaddrassign-03) is one of the trade-offs which should be
considered when deciding on a mechanism. That's all.

> - The security offered by UDP is easily overcome with very modest 
> resources. The CPU/GPU reference is made to illustrate the point that 
> computationally it is trivial, and it's worth adding that bandwidth wise 
> it is also likely to be so esp on a high speed link.

But what do you have to compute anyway? It's just trying 2^32 values
until you get "a bingo". So I don't think it is the computational 
complexity which is relevant here, but rather bandwidth or preferrably
packet rate. That's why I would just remove the GPU part.

> The paper you indicated provides a neat summary of the level of security 
> based on source ports as offered by many implementations still today, 
> including those of CPEs:
> 
> ---snip---
> 
> Moreover, ephemeral source ports are not actually selected from the full 
> 16-bit range, but a smaller subset range.Ports 1-1024 are reserved for 
> privileged processes, and ports 49152-65535 are reserved for private 
> ports.In some cases, operating systems have even reserved ports 
> 5001-65535 for private usage, leaving only 3977 ports for dynamic kernel 
> assignment.
> 
> Currently, existing source port selection is so predictable as to make 
> guessing reasonably trivial; even for the blind TCP spoofing attacker.

Indeed. But I think have to consider long-term consequences? I can
imagine that operating systems will start to implement RFC 6056 eventually
and when they do, it will be these NAT-based port-restricted mechanisms,
which will degrade security (of course, only to certain extent). And
people should be aware of this.

Thanks,
Nejc