Re: tcpm-antispoof and TCP's weakness [Re: [tcpm] ICMP attacks draft (issue 1): hard errors -> soft errors (in synchronized states)]

[Joe Touch <[e-mail]>]

Pekka Savola wrote:
> On Fri, 30 Sep 2005, Joe Touch wrote:
> 
>>> "The strength of  a chain is that of the weakest link", I mean.
>>
>>
>> But TCP-antispoof explains that the chain is already sufficiently weak
>> in many cases even if you try to fix ICMP.
> 
> 
> While you as an editor of a WG document may have such an individual
> opinion, I didn't get that impression from the draft, and I'd like to
> see the draft changed if that was the intended tone.

My sentence above should have implied "whether you fix ICMP or not". I
do feel that's the case, but I agree that the doc didn't address that -
mostly because this issue wasn't the focus of that doc.

If it is agreed, I'd be glad to add that or something to that effect.

> While the TCP's security (not considering ICMPs) is not very strong, I
> do not think it can be classified as "weak" either, especially in
> scenarios where certain insecurities of IP (e.g., source address
> spoofing) can be eliminated.

Cases where source address spoofing can be eliminated amount to real
security, either by signatures or by trusted edge filtering.

I would conclude that TCP doesn't have security (because it doesn't),
and that this weakness can be made strong by using real security
(TCP/MD5, IPsec). These help ICMP only where the entire payload is
included in the ICMP reply - which goes back to the point I made earlier
about validation needing to do the same thing, BTW.

Joe

_______________________________________________
tcpm mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/tcpm