Re: [tcpm] TCP-AO and ICMP attacks (was Re: comments on draft-ietf-tcpm-icmp-attacks-05)

[Joe Touch <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Fernando Gont wrote:
> Joe,
> 
>> I think we both agree that the text on ICMP handling should be moved out
>> of the security considerations section and put it its own section.
> 
> Agreed.
> 
> 
>> You prefer defaults, and are recommending ICMP handling similar to that
>> in documents the WG has decided not to recommend for TCP not running AO.
> 
> Yes. Note that virtually all real implementations already do this for
> connections that do not use TCP-AO. Nobody is going to change this for
> non-TCP-AO, or even less abort TCP-AO connections in response to ICMP
> error messages.

This document is standards track, and is not intended to validate the
behavior of those implementations. It also doesn't invalidate them.

Note that I am NOT saying that the default is "ICMPs pass" - I said
NOTHING about a default, just like IPsec says nothing.

>> I want to leave TCP-AO's handling of ICMPs the same as IPsec's - up to
>> the user.
> 
> Just making my point clear: I think leaving unspecified what to do with
> ICMP errore messages would be a bad decision. It might end up with
> implementations honoring these error messages, which would mean that
> TCP-AO would be (by default) useless for protecting TCP against
> ICMP-based reset attacks.

TCP-AO does not have a default for connections without keys either.
IPsec does - they're blocked. If we're not having a default for new
connections, we shouldn't have a default for ICMP.

Joe
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAko4RpoACgkQE5f5cImnZrvAUgCfVtwiAvkuJ300eu7bc3XY6MJg
+8MAniF7ffrDTRa8TyLVb/k3lzX0caET
=B8Em
-----END PGP SIGNATURE-----