Re: [Spud] updated draft PLUS charter, rev. 1 June

[Joe Touch <[e-mail]>]

On 6/11/2016 4:49 AM, Brian Trammell wrote:
>> I think Tom has a good point here. PLUS does introduce new communication patterns, passing information to intermediate routers and expecting routers to act on the information. These communication patterns can very well introduce new attack vectors. We actually discussed a few of those on the list some time back. For example, an attacker could inject a packet that mimics the closure of a flow, and cause intermediate firewalls to close the holes open for that flow.
> Except this isn't really a new attack vector; 

Not a new type, but it would be a new instance.

> there's no real difference between this and a FIN/RST injection in TCP, except we get a chance to make the space the attacker has to successfully guess in larger.
It would be very useful to be clear about your threat model before
assuming a given solution.

E.g., no increase in number space will prevent middlebox FIN/RST
manipulation of endpoint associations ("connections").

Joe