RE: [tcpm] feedcback on tcp-secure-05

At 15:04 13/07/2006, Anantha Ramaiah \(ananth\) wrote:

> > The doc should also indicate that preventing these attacks
> > does NOT prevent ICMP attacks (and cite Gont's draft in this
> > regard); it would be useful for the security considerations
> > to address whether ICMPs should be blocked altogether and
> > what the impact of that would be. Without such blocking, it's
> > not clear what the utility of this solution would be.
>
>Ok.

I don't think tcpsecure should make any advice on what to do with ICMP.

Just make it clear that the introduced mechanisms do not prevent 
ICMP-based attacks against TCP, and provide a pointer to 
draft-ietf-tcpm-icmp-attacks-00.txt .

If you are going to make any other statement on this issue, state 
that the ICMP-based attacks are easier to perform, and thus should be 
mitigated (if not, it's ICMP that is the "weakest link in the chain").

You could also add that, fortunately, virtually every implementation 
has mitigated the ICMP attacks described in 
draft-ietf-tcpm-icmp-attacks-00.txt, by implementing most (if not 
all) the counter-measures described in that draft.

Kindest regards,

--
Fernando Gont
e-mail: fernando@gont.com.ar || fgont@acm.org
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www1.ietf.org/mailman/listinfo/tcpm