Re: [Tsvwg] WGLC for Port Randomization starts now (April 1st)

[Randy Stewart <[e-mail]>]

On May 28, 2009, at 11:11 AM, Joe Touch wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
>
>
> Randy Stewart wrote:
>> Joe:
>>
>> In-line..
>>
>> ...
>>> Basically for BSD we take a v-tag used in a connection.. call it  
>>> 'X', and
>>> we place just the tag 'X' into a "timed-wait" cache for 2MSL.  
>>> There is no
>>> restriction on the socket here.. just the tag 'X' will not be used  
>>> again
>>> with this socket.
>
> ...
>>> So basically the socket/port and peer socket/port is re-used right  
>>> away
>>> with
>>> the restriction being that the vtag 'X' cannot be used.
>>
>>> Hope that clears up the issue  :-)
>
> Yes, but it also underscores my concern. What you did was basically:
>
> 	- increase the space available to a single service from
> 	a single IP address
> 		going from TCP's 16 bits (max) of source port to
> 		48 bits of source port + vtag
>
> 	- *decrease* the space available for different
> 	services from different IP addresses
> 		going from TCP's 32 bits of address +
> 		16 bits of source port + 16 bits of
> 		dest port (64 bits) down to only 32


Joe:

I don't follow your meaning here..

I can have

IP-A Port-X Vtag-Y <---->
and
IP-A Port-Y Vtag=Y <---->

existing simultaneously... so I don't see how this decreased the
space for services from different IP addresses...

R




>
>
> Joe
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.9 (MingW32)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
>
> iEYEARECAAYFAkoeqa4ACgkQE5f5cImnZrsNGgCg8Kjm1IoDOf7zN40ChPUt6NOj
> m9EAoKb+AEJRebbaPLyhPNvKGI3ckPZv
> =YNfE
> -----END PGP SIGNATURE-----
>

-----
Randall Stewart
[e-mail]