Re: [tcpm] tcpsecure: how strong to recommend?

[Joe Touch <[e-mail]>]

Tim Shepard wrote:
>>> How's BTNS coming along?   Will we be seeing BGP over BTNS anytime soon?
>>> (I've not been following BTNS too closely recently).
>> See the Goals and Milestones at:
>> http://www.ietf.org/html.charters/btns-charter.html
> 
> 
> Cool.  But that is only a (partial) answer to my first question.  From
> the status of Goals and Milestones on that IETF WG charter page, I
> cannot tell if the result of the BTNS WG is something that is
> sufficiently far along that "go do BTNS" is a viable alternative to
> this "tcpsecure" draft.  Presumably I could read all the drafts that
> are there and form my own opnion, but the queue of things that I ought
> to read soon is much deeper than what I will be able to read soon.
> 
> (For those attempting to follow along... I believe the need that
>  triggered this tcpsecure draft was also (one of?) the trigger(s) that
>  led to the BTNS WG effort.    This tcpsecure draft is a collection of
>  hacks (which appear to solve the problems as we understand them now)
>  while the BTNS effort was started in an attempt to solve the problem
>  in an architecturally correct and more robust way.)

FWIW:

tcpsecure reduces the impact of attacks on TCP that presume knowledge of
the socket pair (src/dst IP, src/dst port), the impetus of which was
attacks on BGP

as noted in RFC4953 (antispoof) discusses protections for such services,
and more direct protections using authentication mechanisms such as
TCP/MD5 (which we have a group revising - stay tuned...) and IPsec.

IPsec is sometimes not used in routers because of the need to configure
preshared keys or certificate authority information; BTNS enables IPsec
without either

BTNS has a large number of potential uses beyond BGP, though. TCP/MD5
and its alternates - despite the formers similar need for preshared keys
- may be more likely to be more widely used for the BGP case.

I.e., as was noted in antispoof, there are many ways to address this
problem, and the problem is of impact only for certain connections.

> At some point there's a decision to be made, recommend what's in the
> tcpsecure draft, or recommend what BTNS has produced.

Or the successor to TCP/MD5, or existing IPsec - and that recommendation
will probably involve collaboration with the Security Area.

> So I ask: is BTNS succeeding such that it is a viable alternative to
> this tcpsecure draft?

One of many alternatives, yes. The only alternative, no.

Joe

_______________________________________________
tcpm mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/tcpm