Re: [tcpm] feedcback on tcp-secure-05: suggested text

On Tue, 18 Jul 2006, Ted Faber wrote:
> I've attached some text that I'd like to propose for the Security
> Considerations secition of this draft in an effort to make its scope
> clear and hopefully address some of Joe's concerns about ICMP.
>
> This is just me, a participant, making the suggestion.
>
> Text is attached.  Let me know what you think.

I'm having practical problems with the second paragraph (the rest 
looks OK).  It seems to imply that RFC 4301 adequately discusses the 
issues and is a useful starting point for developing a prevention 
policy _in practice_ (as very few sessions can use IPsec to prevent 
from ICMP attacks).  My belief is that both of these implications are 
incorrect.

On the other hand, I'd replace the text with references to 
tcpm-antispoof and tcpm-icmp-attacks which both go to some length in 
discussing this issue.  The former could be cited in the first 
paragraph, the latter provided as a main discussion of ICMP attacks in 
the second paragraph.

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www1.ietf.org/mailman/listinfo/tcpm