[tcpm] RFC 5961 on Improving TCP's Robustness to Blind In-Window Attacks

[[e-mail]]

A new Request for Comments is now available in online RFC libraries.

        
        RFC 5961

        Title:      Improving TCP's Robustness to Blind 
                    In-Window Attacks 
        Author:     A. Ramaiah, R. Stewart,
                    M. Dalal
        Status:     Standards Track
        Stream:     IETF
        Date:       August 2010
        Mailbox:    [e-mail], 
                    [e-mail], 
                    [e-mail]
        Pages:      19
        Characters: 44717
        Updates/Obsoletes/SeeAlso:   None

        I-D Tag:    draft-ietf-tcpm-tcpsecure-13.txt

        URL:        http://www.rfc-editor.org/rfc/rfc5961.txt

TCP has historically been considered to be protected against spoofed
off-path packet injection attacks by relying on the fact that it is
difficult to guess the 4-tuple (the source and destination IP
addresses and the source and destination ports) in combination with
the 32-bit sequence number(s).  A combination of increasing window
sizes and applications using longer-term connections (e.g., H-323 or
Border Gateway Protocol (BGP) [RFC4271]) have left modern TCP
implementations more vulnerable to these types of spoofed packet
injection attacks.

Many of these long-term TCP applications tend to have predictable IP
addresses and ports that makes it far easier for the 4-tuple (4-tuple
is the same as the socket pair mentioned in RFC 793) to be guessed.
Having guessed the 4-tuple correctly, an attacker can inject a TCP
segment with the RST bit set, the SYN bit set or data into a TCP
connection by systematically guessing the sequence number of the
spoofed segment to be in the current receive window.  This can cause
the connection to abort or cause data corruption.  This document
specifies small modifications to the way TCP handles inbound segments
that can reduce the chances of a successful attack.  [STANDARDS TRACK]

This document is a product of the TCP Maintenance and Minor Extensions Working Group of the IETF.

This is now a Proposed Standard Protocol.

STANDARDS TRACK: This document specifies an Internet standards track
protocol for the Internet community,and requests discussion and suggestions
for improvements.  Please refer to the current edition of the Internet
Official Protocol Standards (STD 1) for the standardization state and
status of this protocol.  Distribution of this memo is unlimited.

This announcement is sent to the IETF-Announce and rfc-dist lists.
To subscribe or unsubscribe, see
  http://www.ietf.org/mailman/listinfo/ietf-announce
  http://mailman.rfc-editor.org/mailman/listinfo/rfc-dist

For searching the RFC series, see http://www.rfc-editor.org/rfcsearch.html.
For downloading RFCs, see http://www.rfc-editor.org/rfc.html.

Requests for special distribution should be addressed to either the
author of the RFC in question, or to [e-mail].  Unless
specifically noted otherwise on the RFC itself, all RFCs are for
unlimited distribution.


The RFC Editor Team
Association Management Solutions, LLC