Re: [tcpm] poll for adopting draft-gont-tcp-security

[Joe Touch <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Fernando Gont wrote:
> Joe Touch wrote:
> 
>> I don't understand why TCP must be able to be implemented in a secure
>> fashion. 
> 
> Because we don't want our systems to be trivially hacked.

We agree on that.

However, there are different issues here:

	1- protecting a particular TCP connection from attack
	2- protecting an endsystem from resource overload
	3- protecting the data a user transfers

TCP was never intended for any of these. IPsec, and TCP's MD5 and AO
options are intended to address some of these. If you're concerned with
hackers, you protect all three above - which means assuming IPsec and/or
MD5/AO, *then* talking about other issues.

Addressing vulnerabilities in unprotected TCP is like caulking the
windows of a car. It won't make it float.

>> It would be more useful, IMO, to at least admit that and change the
>> above to acknowledge that, e.g., (changing the wording and the level
>> down to SHOULD):
>>
>> - TCP SHOULD be able to be implemented in a way that mitigates, to the
>> extent possible, the impact of exploitable conditions leading to:
> 
> Do we really need to nit-pick at every document and waste cycles in
> end-less discussions that get nowhere, instead of getting stuff done?
> 
> Why don't we work on the document itself? Is there anything you think
> could be improved? Post feedback, and let's improve the document.

I've repeatedly said why I don't want to proceed on this path. It puts
the WG in the position of repeating ourselves on issues we've already
decided. Specific example - ICMP in-window checking. We acknowledge
systems do this, but do NOT recommend it as a security check. I've said
why in at least 3 different IETF meetings, as have others. Yet this doc
recommends it. That exceeds advice of the WG.

If you want this doc to be the basis of work in this WG, why don't
**YOU** start by revising it to at least apply the existing WG positions
on previously discussed advice?

Joe
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkpKWiMACgkQE5f5cImnZrti0ACgzg5DD3SU3xMMhmYC8EbBlq/E
ob4An2c6WSG+znQ37e8yUxr2C3aYlnHP
=M0OE
-----END PGP SIGNATURE-----