Re: [tcpm] [tsv-area] Fwd: Secdir Review of draft-stjohns-sipso-05

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi, Lars,

Are you suggesting we have that discussion there, or that they move this
issue here (e.g., to TCPM or TSVAREA)?

I would expect the latter would be more useful...

Joe

Lars Eggert wrote:
> FYI, this discussion on the main IETF list needs input from transport
> folks. Look at Section 7.3 of draft-stjohns-sipso-05.
> 
> Lars
> 
> Begin forwarded message:
> 
>> From: "ext Steven M. Bellovin" <smb@cs.columbia.edu>
>> Date: October 2, 2008 16:31:29 GMT+03:00
>> To: "Steven M. Bellovin" <smb@cs.columbia.edu>
>> Cc: draft-stjohns-sipso-05@tools.ietf.org, Sam Hartman
>> <hartmans-ietf@mit.edu>, secdir@mit.edu, ietf@ietf.org
>> Subject: Re: Secdir Review of draft-stjohns-sipso-05
>>
>> On Wed, 1 Oct 2008 22:12:17 -0400
>> "Steven M. Bellovin" <smb@cs.columbia.edu> wrote:
>>
>>>>    Steven> Note 7.3.1 on
>>>>    Steven> TCP considerations.  (Also note that 7.3.1 disagrees
>>>>    Steven> with 793 on the treatment of security labels in section
>>>>    Steven> 3.6 of 793.  At the least, this shoudl be noted.
>>>>
>>>> I had completely missed this.  I'll call out the section to the
>>>> transport ADs
>>>>
>>> I should have added: I think the new document is in fact more correct
>>> than 793 -- the 793 scheme would permit various forms of
>>> high-bandwidth covert channels to be set up.  This is an issue that
>>> was not nearly that well understood when 793 was written.  That said,
>>> it is a change to TCP, and needs to be treated as such.
>>>
>> Thinking further -- I suspect that the right thing to do here is for
>> someone to write a short, simple draft amending 793 -- it's handling of
>> the security option is simply wrong, independent of this draft.  I
>> wonder -- what TCPs actually implement even 793?  NetBSD doesn't; I
>> strongly suspect that no BSDs do.  Does Solaris?  Linux?
>>
>>         --Steve Bellovin, http://www.cs.columbia.edu/~smb
>> _______________________________________________
>> Ietf mailing list
>> Ietf@ietf.org
>> https://www.ietf.org/mailman/listinfo/ietf
> 
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkjlA7UACgkQE5f5cImnZrszXQCeNkIxxBZUmEjidZBxwF5RMaDg
sgEAn3aoDE4kcBsV7kglGiXvKbRWZwK6
=fiTu
-----END PGP SIGNATURE-----
_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www.ietf.org/mailman/listinfo/tcpm