Re: [tcpm] tcp-security: Request for feedback on the outline of the document

[Fernando Gont <[e-mail]>]

Eddy, Wesley M. (GRC-MS00)[Verizon] wrote:


>> Then it'd be useful to break down TCP into its component parts, as
>> introduced in 2a:
>>
>> 	3 control attacks
>> 		header fields
>> 		option fields
>> 		connection establishment
>> 		connection termination
>> 		port scanning
[....]
> 
> I like the hierarchy that Joe suggests; it groups similar issues and
> recommendations together, and I agree with  him that it would pose
> no difficulty for implementers to use.

I think that for many attacks, the outline Joe is proposing becomes
ambiguous.

e.g., think about the "Rose attack" described in the MSS section. The
attack employs the TCP MSS option (and thus would be included in
"control attacks" according to Joe's outline). However, the attack
attempts to degrade performance. So.. where would the attack be finally
included?

Joe argues that "info leaking" and that port scanning is a "control
attack". But one might argue that port scanning is, in some sense, an
info leaking attack.


> David had suggested that however the document content is organized,
> an appendix can index the recommendations differently.  

I feel comfortable with David proposal, btw.

Thanks,
-- 
Fernando Gont
e-mail: [e-mail] || [e-mail]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1