Re: [tcpm] TCP-AO review comments.

[Joe Touch <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Ron (et al.)

Ron Bonica wrote:
|
|>
|> Basically, this is an application layer problem being foisted upon
|> the transport layer. It creates unneeded clutter at the transport
|> layer that is not of general utility.
|>
|
| Caitlin,
|
| I disagree. TCP-AO protects against some classes of attack against the
| TCP control plane. These attacks cannot be addressed at the application
| layer.

FWIW, I think Caitlin is referring to BGPs assumption that TCP
connectivity implies network connectivity, i.e., when a BGP TCP
connection is dropped, the routes should be removed immediately. I agree
with her that this is an application layer problem (IMO, an application
layer making invalid assumptions).

That doesn't prevent the need for a transport layer protection for
transport connections (as you note below). There's utility in protecting
invested TCP state - e.g., large window sizes, or pending transfers -
from attackers, even when applications use TCP appropriately.

Joe

| For example, there is nothing that can be done at the application layer
| to protect against the insertion of an empty TCP segment with the reset
| bit set. TCP-AO protects against this.


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkieztMACgkQE5f5cImnZrvunQCgwjoDJepuINA6y1wReDmFlGDq
EBAAoMMeSbP+lPKhlyp1VG9+8tdfFaI/
=vnB5
-----END PGP SIGNATURE-----
_______________________________________________
tcpm mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/tcpm