Re: [tcpm] feedcback on tcp-secure-05

Anantha Ramaiah (ananth) wrote:
>  Inline comments...
> 
>> -----Original Message-----
>> From: Joe Touch [mailto:touch@ISI.EDU] 
>> Sent: Thursday, July 13, 2006 10:28 AM
>> To: tcpm@ietf.org
>> Subject: [tcpm] feedcback on tcp-secure-05
>>
>> I had the following comments on v05.
>>
>> Joe
>> --------
>>
>> The doc continues to have a detailed but somewhat incomplete 
>> discussion of the attack scenario; the point of tcp-antispoof 
>> was to provide a much more detailed version of that 
>> discussion that should not be recapitulated but rather cited.
>>
>> The doc cites a *very* old version of tcp-antispoof, too.
> 
> Is the suggestion to take out some verbiage on the attack scenario(s)
> mentioned in the document. If so which sections are of concern?

That should be obvious in the doc, the section that outlines the problem
can be condensed to a summary paragraph and a citation.

> The comment of citing a new version of tcp-antispoof is taken and will
> be relected in the upcoming version.
> 
>> No reasoning is given for numeric limits to ACK throttling 
>> (why 10 in 5 seconds? why not a ratio of the number of 
>> conventional ACKs provided)
> 
> The reasoning given for numeric limits is by no means meant to reflect
> the exhaustive set of possibilities for ACK throttling. Is the
> suggestion to provide a complete list of ACK throttling possibilities?

No, just to give a reason for picking the numbers 10 and 5, and whether
those numbers are context-dependent or not (i.e., if some assumptions
change, then would the numbers change?)

>> TCP-MD5 isn't considered as a useful protection from these 
>> attacks (and it is).
> 
> Using TCP-MD5 makes the attacks described in this document much harder
> than without MD5.
> So beats me as to why TCP-MD5 isn't useful. Can you please elaborate? 

To be more clear, the document doesn't describe that TCP-MD5 solves this
problem. I'm asking that the doc say what you do above. ;-)

Joe

Re: [tcpm] feedcback on tcp-secure-05

Attachment: signature.asc