Re: [tcpm] feedcback on tcp-secure-05

Joe Touch <touch@ISI.EDU> Mon, 17 July 2006 05:01 UTC

Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1G2LET-0007ry-97; Mon, 17 Jul 2006 01:01:25 -0400
Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1G2LES-0007rt-R9 for tcpm@ietf.org; Mon, 17 Jul 2006 01:01:24 -0400
Received: from vapor.isi.edu ([128.9.64.64]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1G2LER-0000EY-EL for tcpm@ietf.org; Mon, 17 Jul 2006 01:01:24 -0400
Received: from [192.168.1.42] (pool-71-106-102-77.lsanca.dsl-w.verizon.net [71.106.102.77]) by vapor.isi.edu (8.11.6p2+0917/8.11.2) with ESMTP id k6H50SH15837; Sun, 16 Jul 2006 22:00:29 -0700 (PDT)
Message-ID: <44BB1965.9070305@isi.edu>
Date: Sun, 16 Jul 2006 22:00:21 -0700
From: Joe Touch <touch@ISI.EDU>
User-Agent: Thunderbird 1.5.0.4 (Windows/20060516)
MIME-Version: 1.0
To: Fernando Gont <fernando@gont.com.ar>
Subject: Re: [tcpm] feedcback on tcp-secure-05
References: <44B682AB.9010702@isi.edu> <7.0.1.0.0.20060715162015.085dce90@gont.com.ar>
In-Reply-To: <7.0.1.0.0.20060715162015.085dce90@gont.com.ar>
X-Enigmail-Version: 0.94.0.0
X-ISI-4-43-8-MailScanner: Found to be clean
X-MailScanner-From: touch@isi.edu
X-Spam-Score: 0.0 (/)
X-Scan-Signature: 3e15cc4fdc61d7bce84032741d11c8e5
Cc: tcpm@ietf.org
X-BeenThere: tcpm@ietf.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: TCP Maintenance and Minor Extensions Working Group <tcpm.ietf.org>
List-Unsubscribe: <https://www1.ietf.org/mailman/listinfo/tcpm>, <mailto:tcpm-request@ietf.org?subject=unsubscribe>
List-Post: <mailto:tcpm@ietf.org>
List-Help: <mailto:tcpm-request@ietf.org?subject=help>
List-Subscribe: <https://www1.ietf.org/mailman/listinfo/tcpm>, <mailto:tcpm-request@ietf.org?subject=subscribe>
Content-Type: multipart/mixed; boundary="===============1055655331=="
Errors-To: tcpm-bounces@ietf.org


Fernando Gont wrote:
> At 14:28 13/07/2006, Joe Touch wrote:
> 
>> The doc should also indicate that preventing these attacks does NOT
>> prevent ICMP attacks (and cite Gont's draft in this regard); it would be
>> useful for the security considerations to address whether ICMPs should
>> be blocked altogether and what the impact of that would be. Without such
>> blocking, it's not clear what the utility of this solution would be.
> 
> I disagree with having the security considerations section of a document
> that does not focus on ICMP to basically propose to eliminate ICMP.
> 
> There's an entire document of this very same WG dicussing the
> relationship between ICMP and TCP.


The ICMP document is a general document; this document (IMO) is more
about what to do when under suspected attack (or should be, to some extent).

If tcp-secure doesn't recommend blocking when tcp-secure is active
(i.e., when such attacks are suspected), then there is no point to the
rest of tcp-secure. It is useless to address the more challenging
spoofing attack vector and not address the easier one.

Joe


_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www1.ietf.org/mailman/listinfo/tcpm