Re: [Tsvwg] WGLC for Port Randomization starts now (April 1st)

[Joe Touch <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Brian F. G. Bidulock wrote:
> Joe,
> 
> You can hold the old tag long enough to get a new one: a few
> nanoseconds or so...

Sure. Do that a few times, then have packets with the old tag show up
and tell me what happens ;-)

Yes, the space is big, but it's not infinite. Systems are well known to
seed 'random' generators with the same values on reboot. Overall, this
sounds like "security by faith".

Joe

> Joe Touch wrote:                                (Wed, 27 May 2009 09:50:22)
>> While I agree that the term "TIME-WAIT" does not appear in RFC 2690,
>> there is a note:
>>
>> " A new Verification Tag value MUST be used each time the
>>    endpoint tears-down and then re-establishes an association to the
>>    same peer."
>>
>> Can you explain how you know that the tag is new unless you hold it for
>> some period of time?
>>
> 
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkodunwACgkQE5f5cImnZrsjEACfTl4Auix1CYhX1KgLNQh7S1R8
6xEAnA3BGTnf8KhQjylHAsRZXtkCUkrE
=KBIL
-----END PGP SIGNATURE-----