Re: [tcpm] WGLC: draft-ietf-tcpm-tcpsecure-10.txt

[Joe Touch <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi, all,

Some final suggestions:

- --- I believe this document should include an informational reference to
IPsec and TCP-AO in the applicability statement:

   ...Examples of such TCP connections are the ones that
   tend to be long-lived and where the connection end points can be
   determined, in cases where no auxiliary anti-spoofing protection
   mechanisms like TCP MD5 [RFC2385] can be deployed.
                                    ^TCP-AO [I-D...], or IPsec [RFC4301]

- --- concerns with changing TCP behavior should be noted in the
applicability statement, in particular:

   These mitigations
   MAY be implemented in other cases.

, with consideration for the potential implications noted in Section 10.

- --- RFC4953 should be cited as a detailed explanation

"The feasibility of
 this methodology (without mitigations) was first shown in [SITW]."
, and is explained in detail in [RFC4953].

(retain the subsequent reference to 4953's discussion of probabilities)

- ---- section 1.3 can be omitted, as 4953 covers this issue in detail
already, as explained already in section 1.2

If retained, then add TCP-AO and IPsec to TCP MD5 as providing
protection in:

   For applications that can use the TCP MD5 option [RFC2385], such as
   BGP, that option makes the attacks described in this specification
   effectively impossible.

If retained, please omit "draft" from the following:

   For further details regarding the attacks and
   the existing techniques, please refer to draft [RFC4953]

- -- section 10 should similarly refer to TCP-MD5 and TCP-AO where it
refers to IPsec as providing complete protection,

   The only way to fully protect a TCP connection from both on and off
   path attacks is by using either IPSEC-AH [RFC4302] or IPSEC-ESP
   [RFC4303].

IMO, it would be useful to be consistent here, and thus say:
	IPsec [RFC4301], TCP MD5 [RFC...], or TCP-AO [I-D...]

- --- Section 6 should include the context of the recommendation level of
the whole document, e.g.:

   As described in the above sections, recommendation levels for RST,
   SYN and Data are tagged as SHOULD, SHOULD and MAY respectively.

All of the mitigations are subject to the overall recommendations as
indicated in the applicability statement in section Z, notably SHOULD
use where TCP is vulnerable to off-path attacks and is not otherwise
protected, and MAY elsewhere.

Joe

David Borman wrote:
> 
> Wes and I would like to start the WG Last Call for:
> 
>  Title           : Improving TCP's Robustness to Blind In-Window Attacks'
>  Author(s)       : A. Ramaiah, R. Stewart & M. Dalal
>  Filename        : draft-ietf-tcpm-tcpsecure-10.txt
>  Pages           : 27
>  Date            : July 9, 2008
>  Intended Status : Proposed Standard
> 
> http://www.ietf.org/internet-drafts/draft-ietf-tcpm-tcpsecure-10.txt
> 
> It is our understanding that all the feedback has been incorporated into
> this latest version and that there are no known outstanding issues with
> this document.
> 
> Please send feedback to the list, even if it is just a "yes, go ahead
> and publish".
> 
> The WGLC will end on Friday, September 5, 2009.
> 
> 
>         David Borman & Wes Eddy, TCPM WG co-chairs
> 
> 
> _______________________________________________
> tcpm mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/tcpm
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAki3Ep4ACgkQE5f5cImnZrsS7wCdEKaxvUg3XiHXEUF/KNiwycZ0
LW0AnjkqKJ8jt0LvjYf8oBMGjnDKzzIe
=q2Ph
-----END PGP SIGNATURE-----
_______________________________________________
tcpm mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/tcpm