Re: [tcpm] poll for adopting draft-gont-tcp-security

[Fernando Gont <[e-mail]>]

Joe Touch wrote:

> However, there are different issues here:
> 
> 	1- protecting a particular TCP connection from attack
> 	2- protecting an endsystem from resource overload
> 	3- protecting the data a user transfers
> 
> TCP was never intended for any of these. 

TCP was not designed with congestion control in mind... so what? Will
you knock down RFC2581, too?

Whether it was designed with those issues in mind or not, doesn't
matter. TCP operates in hostile environments and therefore, to the
extent that it's possible, it's is desirable that it is as resilient as
possible.



> IPsec, and TCP's MD5 and AO options are intended to address some of these. 

>From your perspective, why would you work on TCP-AO if TCP is not meant
to provide security??



> If you're concerned with
> hackers, you protect all three above - which means assuming IPsec and/or
> MD5/AO, *then* talking about other issues.
> 
> Addressing vulnerabilities in unprotected TCP is like caulking the
> windows of a car. It won't make it float.

You use a helmet when you ride a motorcycle, right? Does that mean that
a motorcycle becomes secure? No it doesn't. But it does mean that you
probably will not get very injured if you fall from your motorcycle at
20 km/h.

C'mon Joe...




>> Why don't we work on the document itself? Is there anything you think
>> could be improved? Post feedback, and let's improve the document.
> 
> I've repeatedly said why I don't want to proceed on this path. It puts
> the WG in the position of repeating ourselves on issues we've already
> decided. Specific example - ICMP in-window checking. We acknowledge
> systems do this, but do NOT recommend it as a security check. I've said
> why in at least 3 different IETF meetings, as have others. Yet this doc
> recommends it. That exceeds advice of the WG.

I had meant to remove most of that ICMP stuff. This is a pending change,
and I thought I had already removed most of that stuff (and replace it
with a small discussion, and a pointer to the ICMP attacks I-D).



> If you want this doc to be the basis of work in this WG, why don't
> **YOU** start by revising it to at least apply the existing WG positions
> on previously discussed advice?

As I said, this is no problem, and I thought I had already applied this
change.

That said, I don't believe this is a show stopper.... (issues solved, as
far as I can tell).

Thanks,
-- 
Fernando Gont
e-mail: [e-mail] || [e-mail]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1