Re: [tcpm] [OPSEC] draft-gont-tcp-security

[Joe Touch <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Fernando Gont wrote:
> Joe Touch wrote:
> 
>>>> 	The diligent blacksmith knows that hardening a tool also
>>>> 	makes it more brittle...
>>> This is a nice quote, but... I'd like examples. e.g., start discussing
>>> about which specific hardening proposal makes TCP more brittle.
>> 1) any security mechanism that increases complexity - of actions, state,
>> or message exchanges - any of which increases the potential for
>> implementation error
> 
> Agreed.
> 
> 
> 
>> 2) any security mechanism that has false positives, i.e., that discards
>> messages deemed a security threat when they were sent for legitimate reasons
> 
> Why would this make e.g., TCP more brittle?

It makes a TCP that used to work not work anymore.

> In any case, the actual response to such packets may vary (e.g., in the
> case of ICMP hard errors, discard vs. process as soft errors). I believe
> that no matter what the recommended response is, it is important to
> discuss these issues, and try to get consensus on what's the right thing
> to do in each case.

Agreed. In a document that aimes to describe just what has been
implemented, there's no goal of gaining community consensus, though.
There is still utility, however, in providing the alternate viewpoint on
the potential impacts of implementations.

>> #1 includes basically everything, from TCP MD5 (and TCP-AO) to tcpsecure
>> and ICMP filtering
> 
> ICMP filtering actually decreases complexity.

It requires more code to check that an ICMP is in-window than to not
check. Nearly everything requires more code, at least.

>> I.e., AFAICT, *everything* that makes TCP more secure also makes it
>> brittle, by definition (ditto for metal hardening, FWIW). The key issue
>> is "when/where is the benefit worth the cost".
> 
> As I said before, I'd like to have concrete examples from the tcp
> security i-d that are deemed to make TCP more brittle.

I did above in both cases.

Joe
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFKLsDME5f5cImnZrsRAlGWAKCzYpIm7avI7zCezK/qr6+YOmLzogCg+hQe
miDFj33au36GsANaWpxiM4w=
=6lOt
-----END PGP SIGNATURE-----