Re: [Spud] updated draft PLUS charter, rev. 1 June

[Tom Herbert <[e-mail]>]

> You're raising an issue with any protocol that runs over UDP in an Internet with echo servers in it, and my understanding is the arrangement you're proposing here is:

Plus introduces new issues. All prior uses of UDP on the Internet have
been end to end communications, application to application. PLUS is
introducing the notion that UDP is used for application to network and
network to application communications also. For end to end
communications we can apply strong security (e.g. DTLS) so that
spoofed or reflected UDP packets are not accepted.

The issues are even worse if intermediate devices are allowed to
modify payloads. Consider that we can not retroactively reserve a
stream of bits at the beginning of every UDP payload to indicate PLUS.
Regardless of how much data we collect on a set of safe bits to use,
eventually some user will happen send those same exact bits in their
application protocol. If such packets are modified by PLUS we now have
introduced a silent data corruption. A protocol that allows silent
data corruptions cannot be considered correct.

>
> ip
>  (EH for path exposure)
> udp
>   dtls
>      (new protocols)
>
> whereas the one I think works is:
>
> ip
> udp
>   plus for path exposure
>     dtls
>       (new protocols)
>
> I don't see how these are any different with respect to how they have to handle the echo server attack. What am I missing here?
>
The difference is that in case one the EH headers in a packet sent an
echo server and not automatically reflected in the reply packet. In
case #2 the whole UDP payload is reflected so the faux PLUS header is
reflected and devices on the return path will process that information
as signals to the network being sent from the Echo Server. This allows
an attacker to affect the affect the devices in the reverse path.

> My impression is that HBH options were being more or less deprecated, because they're largely unimplementable in hardware, due to unpredictable header chain lengths and header chain walking time. Am I incorrect here?
>
If nodes can't process HBH headers they can be ignored. This needs to
be clarified in 2460bis.

Tom