[tcpm] I-D Action:draft-ietf-tcpm-tcpsecure-10.txt

["Anantha Ramaiah (ananth)" <[e-mail]>]

Greetings,

The new version of the tcpsecure (version 10) incorporates the following
:-

#1 - the last pending issue before WGLC viz., the strength of
mitigations, where there was a "very thin consensus" for tagging the
RST, SYN and Data mitigations as SHOULD/SHOULD/MAY respectively. (It was
previously tagged as SHOULD/SHOULD/SHOULD). The document is modified
accordingly.

#2 - Andre Oppermann brought about some important errors in the
document. They are :- 

a) In the SYN mitigation (sec 4.2) there was a typo when quoting RFC 793
i.e. instead of saying  [RCV.NXT =< SEG.SEQ < RCV.NXT+RCV.WND], it was
misquoted as [RCV.NXT =< SEG.SEQ =< RCV.NXT+RCV.WND]
b) In the Data mitigation section, the text was wrong. I.e. it
previously said :  Data that doesn't satisfy the new check MUST be
discarded silently, it should have been "data that doesn't satisfy the
new check MUST be discarded and an ACK sent (as per the RFC 793)

The document is corrected accordingly.

#3 - A reference to ICMP attacks document, which Fernando brought about.
Ted Faber/Joe Touch suggested the text which I have incorporated in the
security considerations.

#4 - Alfred Hoenes editorial comments on version 9.

I have added a section called "strength of mitigations". The rationale
for adding this section is that, to clear up the reasoning, for tagging
the mitigations strengths as S/S/M esp. after the "Applicability
statement" is in place. Digging through the responses (textual and
verbal) I don't see a strong technical reasoning for choosing the Data
mitigation as MAY. I request the WG members who voted for MAY to speak
up their technical reasoning. Pl remember that this reasoning is highly
desirable since in future many people may ask the same question and
hence it is prudent to come with a better technical explanation.

Thanks,
-Anantha
-----Original Message-----
From: [e-mail] [mailto:[e-mail]] On Behalf Of
[e-mail]
Sent: Wednesday, July 09, 2008 12:30 AM
To: [e-mail]
Cc: [e-mail]
Subject: [tcpm] I-D Action:draft-ietf-tcpm-tcpsecure-10.txt

A New Internet-Draft is available from the on-line Internet-Drafts
directories.
This draft is a work item of the TCP Maintenance and Minor Extensions
Working Group of the IETF.


	Title           : Improving TCP's Robustness to Blind In-Window
Attacks
	Author(s)       : A. Ramaiah, et al.
	Filename        : draft-ietf-tcpm-tcpsecure-10.txt
	Pages           : 27
	Date            : 2008-07-09

TCP has historically been considered protected against spoofed off- path
packet injection attacks by relying on the fact that it is difficult to
guess the 4-tuple (the source and destination IP addresses and the
source and destination ports) in combination with the 32 bit sequence
number(s).  A combination of increasing window sizes and applications
using longer term connections (e.g.  H-323 or Border Gateway Protocol
[RFC4271]) have left modern TCP implementations more vulnerable to these
types of spoofed packet injection attacks.

Many of these long term TCP applications tend to have predictable IP
addresses and ports which makes it far easier for the 4-tuple to be
guessed.  Having guessed the 4-tuple correctly, an attacker can inject a
RST, SYN or DATA segment into a TCP connection by systematically
guessing the sequence number of the spoofed segment to be in the current
receive window.  This can cause the connection to either abort or
possibly cause data corruption.  This document specifies small
modifications to the way TCP handles inbound segments that can reduce
the chances of a successful attack.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-tcpm-tcpsecure-10.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

_______________________________________________
tcpm mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/tcpm