Re: [tcpm] I-D Action:draft-ietf-tcpm-tcpsecure-11.txt

At 01:15 a.m. 03/11/2008, Internet-Drafts@ietf.org wrote:

>TCP has historically been considered protected against spoofed off-
>path packet injection attacks by relying on the fact that it is
>difficult to guess the 4-tuple (the source and destination IP
>addresses and the source and destination ports) in combination with
>the 32 bit sequence number(s).  A combination of increasing window
>sizes and applications using longer term connections (e.g.  H-323 or
>Border Gateway Protocol [RFC4271]) have left modern TCP
>implementations more vulnerable to these types of spoofed packet
>injection attacks.

It was pointed out by a number of us (e.g., Joe Touch and me) that 
this document should probably reference the ongoing work at tsvwg on 
port randomization 
(http://www.ietf.org/internet-drafts/draft-ietf-tsvwg-port-randomization-02.txt).

Considering that nowadays TCP implementations such as that FreeBSD, 
OpenBSD, Linux, and Cisco itself do implement some form of ephemeral 
port randomization, some statements in the document wrt port 
randomization seem inacurate. (e.g., do *current* TCP implementations 
used for servicing BGP not randomize their ephemeral ports).

(FWIW, I don't care about our doc being referenced.... but talking 
about guessing the connection-id while ignoring what is currently 
being done about ephemeral port selection doesn't seem quite right to me).

Thanks!

Kind regards,

--
Fernando Gont
e-mail: fernando@gont.com.ar || fgont@acm.org
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www.ietf.org/mailman/listinfo/tcpm