Re: [tcpm] WGLC: draft-ietf-tcpm-tcpsecure-10.txt

[Fernando Gont <[e-mail]>]

At 08:55 p.m. 28/08/2008, Anantha Ramaiah (ananth) wrote:

>    It was mentioned earlier that a reference in the security
>consideration section to ICMP attacks draft is needed. This was done in
>the latest version (ver 10). I am not sure about the port randomization
>though, but I can add it if the WG feels so.

The whole debate of RST attacks had to do with Paul Watson coming to 
the conclusion that these attacks were much more feasible than 
previously assumed (e.g., by some presentation that had been made at NANOG).

Paul's presentation assumed a global and linear ephemeral-port 
selection function. IMO, the most obvious and trivial way to mitigate 
these blind attacks is to randomize the ephemeral port numbers.

And this is even more so when there's a BCP-candidate document that 
has been adopted by a related WG.



>    IMO, all the recent TCP connection robustness related drafts (port
>randomization, ICMP attacks etc.,) should have a reference to TCP secure
>since most of these drafts were inspired by TCP secure!

I don't quite understand this comment. My motivation for suggesting 
references to these documents are:

* It does not make sense to address the most difficult attack vector 
for reset attacks if you leave a much more trivial one open (that's 
the reason for the reference to the ICMP attacks draft).
* tcpsecure aims at mitigating blind in-window attacks. With an 
incremental ephemeral-port selection function, these attacks are not 
as "blind" as they "should" be. If you randomize ephemeral-ports, 
then the attack will require many more packets. (this is the reason 
for the reference to the port randomization draft).

That said, the ICMP attack draft does reference tcpsecure. However, 
it was inspired by the discussions we had while writing the "Security 
Considerations" section of the soft errors draft. The non-wg -00 
version of the port randomization I-D was written by M. Larsen... so 
I have no idea what inspired him to write that document. Maybe 
tcpsecure, maybe Paul Watson's presentation.... maybe he had already 
been working on that.

Thanks!

Kind regards,

--
Fernando Gont
e-mail: [e-mail] || [e-mail]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1




_______________________________________________
tcpm mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/tcpm