Re: [Spud] updated draft PLUS charter, rev. 1 June

[Christian Huitema <[e-mail]>]

On Friday, June 10, 2016 9:04 AM, Tom Herbert wrote:
> ...
> Plus introduces new issues. All prior uses of UDP on the Internet have been end
> to end communications, application to application. PLUS is introducing the
> notion that UDP is used for application to network and network to application
> communications also. For end to end communications we can apply strong
> security (e.g. DTLS) so that spoofed or reflected UDP packets are not accepted.

I think Tom has a good point here. PLUS does introduce new communication patterns, passing information to intermediate routers and expecting routers to act on the information. These communication patterns can very well introduce new attack vectors. We actually discussed a few of those on the list some time back. For example, an attacker could inject a packet that mimics the closure of a flow, and cause intermediate firewalls to close the holes open for that flow.

I suggest that we recognize the link between new patterns and new attacks in the charter, and have an explicit goal to investigate these attacks and their mitigations. 

-- Christian Huitema