RE: [tcpm] feedcback on tcp-secure-05

Fernando, 

> -----Original Message-----
> From: Fernando Gont [mailto:fernando@gont.com.ar] 
> Sent: Saturday, July 15, 2006 11:43 AM
> To: Anantha Ramaiah (ananth); Joe Touch; tcpm@ietf.org
> Subject: RE: [tcpm] feedcback on tcp-secure-05
> 
> At 15:04 13/07/2006, Anantha Ramaiah \(ananth\) wrote:
> 
> > > The doc should also indicate that preventing these 
> attacks does NOT 
> > > prevent ICMP attacks (and cite Gont's draft in this regard); it 
> > > would be useful for the security considerations to 
> address whether 
> > > ICMPs should be blocked altogether and what the impact of 
> that would 
> > > be. Without such blocking, it's not clear what the 
> utility of this 
> > > solution would be.
> >
> >Ok.
> 
> I don't think tcpsecure should make any advice on what to do 
> with ICMP.
> 
> Just make it clear that the introduced mechanisms do not 
> prevent ICMP-based attacks against TCP, and provide a pointer 
> to draft-ietf-tcpm-icmp-attacks-00.txt .

I agree.. 

May be we should just say something like : "The mitigations discussed in
this document does not prevent ICMP attacks" and provide a citation to
your document.

One of the reasons why it was felt that the above isn't necessary is
because : tcpsecure refers Joe's antispoof which in turn refers your
document. 

> 
> If you are going to make any other statement on this issue, 
> state that the ICMP-based attacks are easier to perform, and 
> thus should be mitigated (if not, it's ICMP that is the 
> "weakest link in the chain").
> 
> You could also add that, fortunately, virtually every 
> implementation has mitigated the ICMP attacks described in 
> draft-ietf-tcpm-icmp-attacks-00.txt, by implementing most (if not
> all) the counter-measures described in that draft.

We really don't want to cause a bloat to the security considerations
section. Also the scope the document is limited and it is better to
stick to that. 

-Anantha
> 
> Kindest regards,
> 
> 
> --
> Fernando Gont
> e-mail: fernando@gont.com.ar || fgont@acm.org PGP 
> Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1
> 
> 
> 
> 

_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www1.ietf.org/mailman/listinfo/tcpm