Re: [tcpm] PoC for draft-moncaster-tcpm-rcv-cheat-02

On Wed, Mar 26, 2008 at 08:21:49PM +0200, Pekka Savola wrote:
> On Wed, 26 Mar 2008, Bob Briscoe wrote:
> > I'd tend to agree with ROb - publication is unlikely to get the
> > solution out there any quicker.
> 
> First, I suggest you or someone contact the most interesting vendors 
> (some BSD and Linux communities) about this and potentially obtain a 
> CVE number.  Fernando Gont might be willing to help with this process 
> as he has been through it before.

When I first published my paper (2005), I brought the issue up with
CERT and they issued the problem [VU#102014]
(http://www.kb.cert.org/vuls/id/102014).  While not a CVE, I believe it
has the same effect (maybe others may disagree).  

> But if you believe this issue is progressing in the IETF, maybe 
> publishing the PoC is premature.  If the progress is slow I'd suggest 
> contacting vendors' security teams now.

I contact vendors in 2005, and the response was luke warm (as was the
response on this list).  My take on this issue is that people are
divided into three[1] camps:

a) people who do not believe this attack practical
b) people who believe the attack is practical, but not dangerous enough
	to motivate patching TCP implementations
c) people who believe this attack is practical and dangerous, but felt
	my randomly-skipped segments solution was not "good" for
	reasons of efficiency, correctness, etc.

In my mind, publishing the PoC could convince people in group (a) to
move to group (b).  If the attack were to become active in the wild,
then maybe people might move from (b) to (c).  But that still leaves
the bottleneck on people in group (c) to come up with a "good"
solution.  Bob Briscoe et al. have come up with a variant on my
solution, but I am not certain how well its been scrutinised or if it
has even been implemented.

So, in my mind, the best case is that publishing the PoC could get more
people looking at potential solutions to the attack, at the cost of
potentially causing widespread DoS.  Given that analysis, I chose not
to publish my code, but I will leave it to Stefanos to decide what to
do with his.

- Rob
.

[1] I guess there is a forth group (namely, me) that believed the attack
was practical and dangerous, and that the skipped segment solution was
good, but I guess we can discount that :-)
_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www.ietf.org/mailman/listinfo/tcpm