Re: [Tsvwg] Port Randomization issues summary

[Joe Touch <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Fernando Gont wrote:
> Hello, Joe,
> 
>> 1) randomizing connection IDs helps protect against blind attacks
>>
>> 	- but ultimately the only way to avoid old segments
>> 	from interfering with new connections is to keep state
> 
> Yes. But... what does this have to do with port randomization?

It underscores the need to keep state in the endpoints, rather than just
trust that randomization will provide safety.

>> 	- randomness requires keeping more state at the endpoints
>> 	than sequential use of the ID space
> 
> Why?

If IDs are used in sequence, and endpoint can keep track of "do not use"
ones using two IDs (representing the range to be avoided). If IDs are
used randomly, then the endpoint needs a copy of each value to avoid.

>> 3) randomness is costly
>>
>> 	as SCTP demonstrated, asserting randomness may be better
>> 	done by referring to existing separate definitions
> 
> I didn't follow the recent discussion of TIME-WAIT state in SCTP, etc.
> Could you clarify this one?

See RFC4960, sec 5.3.1., which refers off to RFC4086 to define
randomness, rather than defining it within the SCTP spec.

Joe
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkoe+NgACgkQE5f5cImnZrs4bQCghb7UvpeaeumMbqAt6od61wDh
f74AoKWITAKu3eqis0uh/xGR308mu5ZI
=CqPW
-----END PGP SIGNATURE-----