Re: [tcpm] Fwd: Secdir Review of draft-stjohns-sipso-05

Lars Eggert <lars.eggert@nokia.com> Sat, 04 October 2008 06:55 UTC

Return-Path: <tcpm-bounces@ietf.org>
X-Original-To: tcpm-archive@megatron.ietf.org
Delivered-To: ietfarch-tcpm-archive@core3.amsl.com
Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5A76A3A6947; Fri, 3 Oct 2008 23:55:21 -0700 (PDT)
X-Original-To: tcpm@core3.amsl.com
Delivered-To: tcpm@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 62C5D3A6850 for <tcpm@core3.amsl.com>; Fri, 3 Oct 2008 23:55:20 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level:
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=-0.000, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8NTqjL-otOwg for <tcpm@core3.amsl.com>; Fri, 3 Oct 2008 23:54:51 -0700 (PDT)
Received: from mail.fit.nokia.com (unknown [IPv6:2001:2060:40:1::123]) by core3.amsl.com (Postfix) with ESMTP id 2DF2B28C1AC for <tcpm@ietf.org>; Fri, 3 Oct 2008 23:54:49 -0700 (PDT)
Received: from [192.168.255.2] (a88-114-157-111.elisa-laajakaista.fi [88.114.157.111]) (authenticated bits=0) by mail.fit.nokia.com (8.14.3/8.14.3) with ESMTP id m946tC0X089102 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT) for <tcpm@ietf.org>; Sat, 4 Oct 2008 09:55:12 +0300 (EEST) (envelope-from lars.eggert@nokia.com)
Message-Id: <B00739A3-F483-4134-B67B-BBEBE1CDDBA5@nokia.com>
From: Lars Eggert <lars.eggert@nokia.com>
To: tcpm Extensions WG <tcpm@ietf.org>
In-Reply-To: <1ABB0C9F-EAF3-445D-B8E1-58110496291C@nokia.com>
Mime-Version: 1.0 (Apple Message framework v929.2)
Date: Sat, 4 Oct 2008 09:55:11 +0300
References: <20081002093129.5bb80658@cs.columbia.edu> <1ABB0C9F-EAF3-445D-B8E1-58110496291C@nokia.com>
X-Mailer: Apple Mail (2.929.2)
X-Virus-Scanned: ClamAV 0.94/8373/Sat Oct 4 05:00:50 2008 on fit.nokia.com
X-Virus-Status: Clean
X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.0 (mail.fit.nokia.com [212.213.221.39]); Sat, 04 Oct 2008 09:55:18 +0300 (EEST)
Subject: Re: [tcpm] Fwd: Secdir Review of draft-stjohns-sipso-05
X-BeenThere: tcpm@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: TCP Maintenance and Minor Extensions Working Group <tcpm.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/tcpm>, <mailto:tcpm-request@ietf.org?subject=unsubscribe>
List-Archive: <https://www.ietf.org/mailman/private/tcpm>
List-Post: <mailto:tcpm@ietf.org>
List-Help: <mailto:tcpm-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tcpm>, <mailto:tcpm-request@ietf.org?subject=subscribe>
Content-Type: multipart/mixed; boundary="===============1397074206=="
Sender: tcpm-bounces@ietf.org
Errors-To: tcpm-bounces@ietf.org

This is now being discussed on the tsv-area@ietf.org and saag@ietf.org  
lists. Please join the discussion there.

Lars

On 2008-10-2, at 16:55, ext Lars Eggert wrote:

> FYI, this discussion on the main IETF list needs input from  
> transport folks. Look at Section 7.3 of draft-stjohns-sipso-05.
>
> Lars
>
> Begin forwarded message:
>
>> From: "ext Steven M. Bellovin" <smb@cs.columbia.edu>
>> Date: October 2, 2008 16:31:29 GMT+03:00
>> To: "Steven M. Bellovin" <smb@cs.columbia.edu>
>> Cc: draft-stjohns-sipso-05@tools.ietf.org, Sam Hartman <hartmans-ietf@mit.edu 
>> >, secdir@mit.edu, ietf@ietf.org
>> Subject: Re: Secdir Review of draft-stjohns-sipso-05
>>
>> On Wed, 1 Oct 2008 22:12:17 -0400
>> "Steven M. Bellovin" <smb@cs.columbia.edu> wrote:
>>
>>>>   Steven> Note 7.3.1 on
>>>>   Steven> TCP considerations.  (Also note that 7.3.1 disagrees
>>>>   Steven> with 793 on the treatment of security labels in section
>>>>   Steven> 3.6 of 793.  At the least, this shoudl be noted.
>>>>
>>>> I had completely missed this.  I'll call out the section to the
>>>> transport ADs
>>>>
>>> I should have added: I think the new document is in fact more  
>>> correct
>>> than 793 -- the 793 scheme would permit various forms of
>>> high-bandwidth covert channels to be set up.  This is an issue that
>>> was not nearly that well understood when 793 was written.  That  
>>> said,
>>> it is a change to TCP, and needs to be treated as such.
>>>
>> Thinking further -- I suspect that the right thing to do here is for
>> someone to write a short, simple draft amending 793 -- it's  
>> handling of
>> the security option is simply wrong, independent of this draft.  I
>> wonder -- what TCPs actually implement even 793?  NetBSD doesn't; I
>> strongly suspect that no BSDs do.  Does Solaris?  Linux?
>>
>> 		--Steve Bellovin, http://www.cs.columbia.edu/~smb
>> _______________________________________________
>> Ietf mailing list
>> Ietf@ietf.org
>> https://www.ietf.org/mailman/listinfo/ietf
>
> _______________________________________________
> tcpm mailing list
> tcpm@ietf.org
> https://www.ietf.org/mailman/listinfo/tcpm

_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www.ietf.org/mailman/listinfo/tcpm