Re: tcpm-antispoof and TCP's weakness [Re: [tcpm] ICMP attacks draft (issue 1): hard errors -> soft errors (in synchronized states)]

On Sat, 1 Oct 2005, Joe Touch wrote:
> Cases where source address spoofing can be eliminated amount to real
> security, either by signatures or by trusted edge filtering.
>
> I would conclude that TCP doesn't have security (because it doesn't),
> and that this weakness can be made strong by using real security
> (TCP/MD5, IPsec).

Ack/seq may not be exactly 'strong', but it's still something. 
Regardless of that 'real security' are generic solutions, and may not 
be needed in all the cases.

> These help ICMP only where the entire payload is
> included in the ICMP reply - which goes back to the point I made earlier
> about validation needing to do the same thing, BTW.

Trusted edge filtering is good security.  An ISP or an enterprise 
could (and in fact _do_) perform that.  Spoofed TCP attacks inside 
such a network are prevented -- but ICMP offers a gaping hole.  Ergo, 
if the IETF believes this scenario is sufficiently common and/or 
convincing, this needs to be fixed (and it may make sense to fix it in 
any case).

It should be obvious, but IMHO this scenario calls for a specific 
solution, not just 'use IPsec'.  A majority of networks have prevented 
spoofing already [http://spoofer.csail.mit.edu/], and internal 
protection from ICMP attacks is required.

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www1.ietf.org/mailman/listinfo/tcpm