Re: [tcpm] tcpsecure recommendations

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Anantha Ramaiah (ananth) wrote:
...
| Actaully it is not a "stream" of forged segments. A malicious segment
| (which utilizes the liberal range of ACK value) can come and occupy any
| place within the receive window, it could be in the re-assembly queue/or
| somewhere inline, but this just like a "time-bomb' waiting to explode.

There are three issues listed in the ID:

"Blind reset attack using the RST bit"
"Blind reset attack using the SYN bit"
"Blind data injection attack"

The third one says "data corruption may result" - IMO, data corruption
is a possibility any time you don't use strict authentication, so it's
inaccurate to imply that if these checks are in place that data
corruption won't occur (which is what is implied, IMO).

The ACK war doesn't take down the connection. What takes down the
connection is that it accepted data it shouldn't have. IMO, the UTO
taking the connection down at this point is not as much an attack
succeeding, as it is TCP succeeding in not letting the attack go unnoticed.

Again, I don't see this case as needing a SHOULD. This is a data plane
issue, not, IMO, a control plane one.

...
| Data injection is about strict ACK checking and applies to FIN segments.
| To re-iterate: preventing anything which causes the connection tear down
| maliciously is critical. So it could be a RST/SYN or Data or FIN.

If preventing anything that could cause a malicious teardown is
critical, then use of strict authentication is required. Implications to
the contrary endorse the use of this "protocol robustness" mechanism for
true security (a misconception that the title doesn't help abate).

- ---

Also, FWIW, Section 9 doesn't appear to address the non-amplification
ACK exchange issue promised in the end of each of the previous sections.

Joe

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFHr4GyE5f5cImnZrsRAjCgAJ0eVV71WUdJbgsi3qP/+CCgsNgD0gCeOr4t
cDj47pw0ErxCpgVci+i1dWM=
=bokx
-----END PGP SIGNATURE-----
_______________________________________________
tcpm mailing list
tcpm@ietf.org
http://www.ietf.org/mailman/listinfo/tcpm