IETF Logo Mail Archive

Re: [Spud] [Privsec-program] Detecting and Defeating TCP/IP Hypercookie Attacks

Eliot Lear <lear@cisco.com> Mon, 01 August 2016 10:28 UTC

Return-Path: <lear@cisco.com>
X-Original-To: spud@ietfa.amsl.com
Delivered-To: spud@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D2C3D12D53B for <spud@ietfa.amsl.com>; Mon, 1 Aug 2016 03:28:44 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -15.808
X-Spam-Level:
X-Spam-Status: No, score=-15.808 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-1.287, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id z7rrTF7ylnvw for <spud@ietfa.amsl.com>; Mon, 1 Aug 2016 03:28:43 -0700 (PDT)
Received: from aer-iport-4.cisco.com (aer-iport-4.cisco.com [173.38.203.54]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7D0DE12D13F for <spud@ietf.org>; Mon, 1 Aug 2016 03:28:43 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=2095; q=dns/txt; s=iport; t=1470047323; x=1471256923; h=subject:to:references:from:message-id:date:mime-version: in-reply-to; bh=rmY13vAgslI51glvtCbn04zLy9HTVBsirQGDKMXY3yc=; b=kz/+bDIpCGm7ykW61obZndebdrcZNK7l29QAS+25pQthK4PDGcXMIE5U 41+bzWkDuLRfaEKS+Glcn5AGwv2DdCasZC19aa0LqV0Tm6NLMFN60/BSg XtOUDMKuk6gsqfuWcbv4act2m1qi1fQ7iDgEuZWx6rwE//qktfMde7Nbk o=;
X-Files: signature.asc : 481
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: A0CoBACFI59X/xbLJq1dhEW7YIYdAoF3AQEBAQEBXieEXwEFI2YLGCoCAlcGAQwIAQGILbEfj1sBAQEBAQEBAwEBAQEBAQESDogiglWHQYJaAQSZM4M6gXCJVYFVAYd9hWyQJ1SDfDqJAwEBAQ
X-IronPort-AV: E=Sophos;i="5.28,454,1464652800"; d="asc'?scan'208";a="640660352"
Received: from aer-iport-nat.cisco.com (HELO aer-core-4.cisco.com) ([173.38.203.22]) by aer-iport-4.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 01 Aug 2016 10:28:41 +0000
Received: from [10.61.221.80] ([10.61.221.80]) by aer-core-4.cisco.com (8.14.5/8.14.5) with ESMTP id u71ASemo022088; Mon, 1 Aug 2016 10:28:41 GMT
To: Christian Huitema <huitema@microsoft.com>, Brian Trammell <ietf@trammell.ch>, spud <spud@ietf.org>, "privsec-program@iab.org" <privsec-program@iab.org>
References: <409B6F52-B637-4333-915B-A8127C80C98B@trammell.ch> <BN6PR03MB2675EC471209B4105DFFFD37A8030@BN6PR03MB2675.namprd03.prod.outlook.com>
From: Eliot Lear <lear@cisco.com>
Message-ID: <93554b11-ade5-63fe-7cd9-c0a7582732dd@cisco.com>
Date: Mon, 01 Aug 2016 12:28:40 +0200
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.2.0
MIME-Version: 1.0
In-Reply-To: <BN6PR03MB2675EC471209B4105DFFFD37A8030@BN6PR03MB2675.namprd03.prod.outlook.com>
Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="DH49R9Cmt3t8xrjFWjMdxUMxKN1dtlo7V"
Archived-At: <https://mailarchive.ietf.org/arch/msg/spud/fgnUKN4JyvMAtShNdaO9ldKwh_0>
Subject: Re: [Spud] [Privsec-program] Detecting and Defeating TCP/IP Hypercookie Attacks
X-BeenThere: spud@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Session Protocol Underneath Datagrams <spud.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/spud>, <mailto:spud-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/spud/>
List-Post: <mailto:spud@ietf.org>
List-Help: <mailto:spud-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/spud>, <mailto:spud-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 01 Aug 2016 10:28:45 -0000

Hi Christian,


On 7/31/16 10:10 PM, Christian Huitema wrote:
> The draft mentions the IPv6 flow-ID, but creative intermediaries might
> also manipulate the TOS fields, so maybe there should be a subsection
> describing that too.

Just so that we're clear, the TOS fields, and in particular DHCP were
designed so that they could be overwritten (mostly erased), as required,
by intermediaries.

Eliot

v2.23.0 | Report a Bug | By Email