Re: [tcpm] [OPSEC] draft-gont-tcp-security

["Smith, Donald" <[e-mail]>]

(coffee != sleep) & (!coffee == sleep)
[e-mail] gcia   

> -----Original Message-----
> From: Joe Touch [mailto:[e-mail]] 
> Sent: Monday, April 13, 2009 3:09 PM
> To: Smith, Donald
> Cc: 'Fernando Gont'; '[e-mail]'; '[e-mail]'; 'Joe 
> Abley'; '[e-mail]'; 'Lars Eggert'; 'Eddy,Wesley M. 
> (GRC-RCN0)[Verizon]'
> Subject: Re: [OPSEC] [tcpm] draft-gont-tcp-security
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Donald,
> 
> I'm confused by your post. You appear to believe that TCP is 
> intended to
> be secure. Note that TCP does not require either the MD5 or 
> AO extension.
I didn't mentioned authentication or authorization in my description of security but those
two enhancements do provide some ability for authentication and authorization.
Yes, I do think elements of tcp/ip were designed to address the integrity and availablity.


> 
> Smith, Donald wrote:
> > 
> > (coffee != sleep) & (!coffee == sleep)
> > [e-mail] gcia   
> > 
> >> -----Original Message-----
> >> From: [e-mail] [mailto:[e-mail]] 
> >> On Behalf Of Fernando Gont
> >> Sent: Monday, April 13, 2009 1:23 PM
> >> To: Joe Touch
> >> Cc: [e-mail]; [e-mail]; Joe Abley; [e-mail]; 
> >> Lars Eggert; Eddy,Wesley M. (GRC-RCN0)[Verizon]
> >> Subject: Re: [OPSEC] [tcpm] draft-gont-tcp-security
> >>
> >> Joe Touch wrote:
> >>
> >>>> So we had tcp-secure in 2004, icmp-attacks in 2005, a claim for a
> >>>> trivial attack in 2008 (Outpost24/CERT-FI), and we'll 
> >> probably continue
> >>>> in this line, because we do nothing about it.
> >>> Whether we have this document or not, we will continue to 
> >> have people
> >>> who incorrectly assume that TCP is secure.
> > 
> > Secure is a general term. TCP was intended to address 
> several areas of security.
> > The classic tenets for computer security is:
> > CIA -> Confidentiality, Integrity and Availability.
> > TCP doesn't attempt to address Confidentiality.
> > However it was designed to address integrity and availability so 
> > failures in those areas should be documented and addressed in some
> > fashion.
> 
> Can you explain this? Where is the integrity protection? Where is the
> availability specified?

Checksumming in tcp/ip is intended to provide intregrity protection.
Mind you it is NOT tamper proof but that is the intent.

Detection of lost packets, retransmitions, reassembly of fragments, congestion notification, dynamic routing and many other tcp/ip features are intended to address availablity.

> 
> ...
> >> It's security/resiliency can be improved. After all, if 
> that were not
> >> the case, I guess you're wasting your time with TCP-AO. Or 
> is it that
> >> you believe the only way to improve a protocol is to throw 
> >> crypto at it?
> > 
> > Adding crypto improves confidentiality and integrity but is counter
> > productive to availability as most
> > crypto engines are prone to fairly low pps resource exhaustion
> > attacks.
> 
> All prevention methods are susceptible to computational resource
> attacks, since all increase the operations performed on a 
> packet. 
GTSM is a valuable exception to this statement but other then that I tend to agree:)

>It is
> commonly assumed that this is a desirable tradeoff, and that the
> computational resources can be totally protected with line-rate
> dedicated computation (e.g., hardware assist).
I believe that is a common assumption however I don't believe that assumption is correct.
I do a fair amount of router testing and although some portions of ipv4 are hardware assisted and therefore line-rate there are still many paths to the "slow path". IPv6 has many more routes to the slow path:(

> 
> Joe
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.9 (MingW32)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
> 
> iEYEARECAAYFAknjqdYACgkQE5f5cImnZruhawCgqqkl3NPljMkNRz8buEYROGUO
> R2kAnRHhQmWJVtXq/j2wbNy64q6QWe+u
> =OkiS
> -----END PGP SIGNATURE-----
>