Re: [tcpm] Some comments on tcpsecure

Ted Faber wrote:
> On Mon, Apr 07, 2008 at 01:31:28PM -0700, Joe Touch wrote:
>> Ted Faber wrote:
>>> On Fri, Apr 04, 2008 at 01:21:27PM -0700, Joe Touch wrote:
>>>> ICMPs are already filtered out for security reasons at firewalls. The 
>>>> key here is whether to recommend that action or not.
>>> And, IMHO, hat off, we're not.  Not here anyway.
>> If that's the case, then what's the point of protecting TCP this way?
>>
>> If ICMPs aren't filtered out, then they remain a simpler attack vector, 
>> and thus the protections afforded are moot.
> 
> You understand, of course, that our hypothetical network architect might
> read these documents in the other order - ICMP protections/ingress
> filtering first, then tcpsecure.   In that sequence the point is closing
> the hole remaining after ICMP is blocked and assuming that IPSec (or
> however it's spelled) is ruled out.
> 
> Again, the purpose of this document is to standardize a protocol
> extension that makes a specific attack more difficult.  It is not a
> primer on securing TCP against all attacks - or even all spoofing
> attacks.  It's not the job of a standards document to mandate all
> possible (or even all relevant) countermeasures to all related attacks.
> This document needs to point to the ICMP document - perhaps strongly -
> but needn't RECOMMEND, in a 2119 sense, anything therein.  And given that
> this is a standards document, I don't think it should recommend them
> either.

Fair enough. It can warn - in the security considerations - that these 
protections assume corresponding protections on ICMPs, however. I.e., it 
  would be incorrect to recommend, but it can warn that "without 
corresponding ICMPs, this document may not provide the desired protection"

Joe

Re: [tcpm] Some comments on tcpsecure

Attachment: signature.asc