RE: [tcpm] feedcback on tcp-secure-05

I second Ted's opinion.

-----Original Message-----
From: Ted Faber [mailto:faber@ISI.EDU] 
Sent: Monday, July 17, 2006 11:03 AM
To: Joe Touch
Cc: tcpm@ietf.org
Subject: Re: [tcpm] feedcback on tcp-secure-05

As a participant, not a chair.

On Sun, Jul 16, 2006 at 10:00:21PM -0700, Joe Touch wrote:
> The ICMP document is a general document; this document [tcpsecure 
> --tvf]  (IMO) is more about what to do when under suspected attack (or

> should be, to some extent).

That's more broad a view of tcpsecure than the one I have.  It's a
mitigation of a specific attack vector, not a handbook for dealing with
off-path TCP attacks.  Personally I prefer to keep it more tightly
scoped so there's a chance of finishing it.

> If tcp-secure doesn't recommend blocking when tcp-secure is active 
> (i.e., when such attacks are suspected), then there is no point to the

> rest of tcp-secure. It is useless to address the more challenging 
> spoofing attack vector and not address the easier one.

While I'm not opposed to adding text to that effect, I don't think it's
a requirement.  There are plenty of other possibilities for attack when
the tcpsecure code additions are exercised, and I don't see that this
document needs to address them all.  For that matter, the tcpsecure
document has never proposed a detection mechanism for those attacks.
All that is new work, and IMHO, well beyond the scope of the document
that the WG agreed to.  I'm happy to be convinced otherwise.

--
Ted Faber
http://www.isi.edu/~faber           PGP:
http://www.isi.edu/~faber/pubkeys.asc
Unexpected attachment on this mail? See
http://www.isi.edu/~faber/FAQ.html#SIG

_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www1.ietf.org/mailman/listinfo/tcpm