Re: [tcpm] TCPM and draft-ietf-tcpm-icmp-attacks

[Fernando Gont <[e-mail]>]

Joe Touch wrote:

>>> I agree with Wes that the role of ICMP in the Internet needs to be
>>> re-examined, and some changes made. However, I also believe that many of
>>> the current TCPM "rush to react" changes (including tcpsecure, some of
>>> the ICMP checks, some parts of the TCP cookie transactions proposal) are
>>> a poor substitute for the use of true security (IPsec, TCP-AO), 
>> They are not a substitute. And the recent support by Ran Atkinson
>> (co-author of previous versions of the IPsec std) should be a good hint.
>> See: http://www.ietf.org/mail-archive/web/ietf/current/msg60159.html
> 
> Note that he supports this as offered - Informational.

That's incorrect. Go ask Ran Atkinson.


>>> which
>>> may also need to include more widely-deployable variants with different
>>> levels of protection (e.g., BTNS).
>> Side note: I wonder what would be the result if you submitted BTNS to
>> the same level of "correctness evaluation" as you have submitted this I-D...
>> (Maybe the "BTNS" acronym is an implicit acknowledgement of that?)
> 
> BTNS doesn't redefine the core, *non-secure* TCP service for everyone.

icmp-attacks does not, either. It changes a protocol policy. It doesn't
redefine any service -- TCP is still a connection-oriented realiable
byte-stream protocol. So I don't see your point.

Thanks,
-- 
Fernando Gont
e-mail: [e-mail] || [e-mail]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1