Re: [tcpm] feedcback on tcp-secure-05: suggested text

Pekka Savola wrote:
> On Tue, 18 Jul 2006, Ted Faber wrote:
>> I've attached some text that I'd like to propose for the Security
>> Considerations secition of this draft in an effort to make its scope
>> clear and hopefully address some of Joe's concerns about ICMP.
>>
>> This is just me, a participant, making the suggestion.
>>
>> Text is attached.  Let me know what you think.
> 
> I'm having practical problems with the second paragraph (the rest looks
> OK).  It seems to imply that RFC 4301 adequately discusses the issues
> and is a useful starting point for developing a prevention policy _in
> practice_ (as very few sessions can use IPsec to prevent from ICMP
> attacks).  My belief is that both of these implications are incorrect.

6.1.1 might be the more relevant particular section; it talks about
receipt of unprotected (un-IPsec'd) ICMPs.

> On the other hand, I'd replace the text with references to
> tcpm-antispoof and tcpm-icmp-attacks which both go to some length in
> discussing this issue.  The former could be cited in the first
> paragraph, the latter provided as a main discussion of ICMP attacks in
> the second paragraph.

The other references might be useful, but pointing directly to 6.1.1 is
less indirect and more to the point about the tradeoff of protection vs.
responsiveness.

Joe

Re: [tcpm] feedcback on tcp-secure-05: suggested text

Attachment: signature.asc