Re: [tcpm] Some comments on tcpsecure

> 
> >I can only agree that randomization makes the attack harder to
> >accomplish, but like you noted many systems don't do it today.
> 
> Nowadays, at least FreeBSD, OpenBSD and Linux do it.

Just for the sake of record, we have been doing port randomization in
some of our main protocol stacks for about 3 years or so and the
algorithms we follow are more less the ones recommended in the port
randomization draft.

> Yes. Something along the lines of "TCP port randomization 
> [draft-ietf-port-randomization] increases the amount of work on the 
> side of the attacker by obfuscating the TCP ephemeral port value"
> 
> To make my point clear: I'm not saying you should make "statements" 
> on whether host should or should implement "icmp attacks" or "port 
> randomization". But you should note that the ICMP attacks are easier, 
> and direct people to the icmp attacks draft for more information 
> about this. And you should note that port randomization is a general 
> mitigation-technique for off-path attacks against TCP that require 
> more work on the side of the attacker to successfully perform 
> such attacks.

One point which I wish to add : the long lived nature of some TCP
connections gives enough time for the attacker (attack program) to
successfully penetrate the connection.

I'll leave it to the WG consensus to determine whether citing these
references is ok at this point in the game. 

-Anantha

_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www.ietf.org/mailman/listinfo/tcpm