Re: [tcpm] Some comments on tcpsecure

At 04:55 p.m. 04/04/2008, Joe Touch wrote:

>>The first one is the ICMP attacks draft 
>>(draft-ietf-tcpm-icmp-attacks). While tcpsecure mentions the 
>>security implications of ICMP on TCP conenctions, it does not 
>>reference the I-D. IIRC, this had already been pointed out by Joe 
>>(?). As far as the specifications are concerned, you shouldn't 
>>bother to fix TCP-based reset attacks if you don't fix the the ICMP-based ones.
>
>Agreed; should this doc recommend filtering out ICMPs as a result? 
>(there's no in-window checks that are meaningful, since ICMPs are 
>not guaranteed to be timely) I.e., something stronger than "there's 
>nothing we can do", which is what is implied in the current security 
>considerations.

Ha... So we have been arguing about the ICMP stuff for almost four 
years on the idea that it is too aggressive to require ICMP error 
messages to be in-window, and now we're going to propose to filter 
them out? Seems ironic to me. (And you cannot do it with "frag needed 
and DF bit set". Well, you *could* implement the new PMTUD that does 
not rely on ICMP error messages. But ignoring ICMP error messages 
will increse the PMTUD convergence time).

And, for what is worth, strictly speaking there's no such a thing as 
a TCP MSL, either. TCP's MSL is based on the assumption that the IP 
TTL is decremented at least once every second. And this is not 
warranted, either. There's not such enforcement as there is in, e.g., Delta-t.

>>The other doc is the port randomization draft 
>>(draft-tsvwg-port-randomization).
>
>Also ISN randomization (RFC-1948), for similar reasons. Even though 
>some of the RST attacks span the entire window, knowing the ISN can 
>help during the initial handshake and shortly thereafter.

Agreed. (Although the math in "Slipping in the window" does not 
assume the attacker can predict the ISN).

Kind regards,

--
Fernando Gont
e-mail: fernando@gont.com.ar || fgont@acm.org
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www.ietf.org/mailman/listinfo/tcpm