Re: [tcpm] feedcback on tcp-secure-05: suggested text

Ted/All:

With the minor tweak of pointing directly to
6.1.1 .. I think what you have proposed is
the right set of wording..

Getting bogged down in a ICMP attack issues disortation
is silly and detracts from what we are trying to do...
get tcp-secure finished...

We can have a food-fight over the ICMP attacks document
in the space of that document...

R

Ted Faber wrote:
> I've attached some text that I'd like to propose for the Security
> Considerations secition of this draft in an effort to make its scope
> clear and hopefully address some of Joe's concerns about ICMP.
> 
> This is just me, a participant, making the suggestion.
> 
> Text is attached.  Let me know what you think.
> 
> 
> 
> ------------------------------------------------------------------------
> 
> 
> 
> Implementors should be aware that the attacks detailed in this
> specification are not the only attacks available to an off-path attacker
> and that the countermeasures described herein are not a comprehensive
> defense against such attacks.
> 
> In particular, administrators should be aware that forged ICMP messages
> provide off-path attackers the opportunity to disrupt connections or
> degrade service.  Such attacks may be subject to even less scrutiny than
> the TCP attacks addressed here, especially in stacks not tuned for
> hostile environments.  Section 6.1 of RFC4301 describes the issues
> associated with unauthenticated ICMP messages, e.g., messages from an
> off-path attacker, and is a good starting point for formulating a policy
> on those messages.
> 
> In any case, this RFC details only part of a complete strategy to
> prevent off-path attackers from disrupting services that use TCP.
> Administrators and implementors should consider the other attack vectors
> and determine appropriate mitigations in securing their systems.
> 
> 
> ------------------------------------------------------------------------
> 
> _______________________________________________
> tcpm mailing list
> tcpm@ietf.org
> https://www1.ietf.org/mailman/listinfo/tcpm

-- 
Randall Stewart
NSSTG - Cisco Systems Inc.
803-345-0369 <or> 815-342-5222 (cell)

_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www1.ietf.org/mailman/listinfo/tcpm