Re: Fwd: Sec-dir review of draft-ietf-tsvwg-source-quench-04

[Joe Touch <[e-mail]>]

Hi, all,

On 1/28/2012 1:35 AM, Gorry Fairhurst wrote:
>
> A SecDir review of this draft (below) has raised one issue that the
> group should be aware of and may wish to comment upon.
>
> We'd value advice on the suggestion:
>
> "Receipt of an ICMP Source Quench message should not be interpreted as
> an attempt to attack the receiver."
...
> - The current draft says *must* not be interpreted as an attempt to
> attack the receiver, is that right, or do we wish to consider the
> proposal to make this *should* not?

MUST NOT seems required by MUST silently ignore (section 3). That's what 
"silent" and "ignore" means.

Using "SHOULD NOT" leaves open this misinterpretation, and thus *opens* 
a vulnerability at the receiver to spoofed messages - i.e., it's 
inconsistent with the security implications of this doc, notably:

---
Receipt of an ICMP Source Quench
    message must not be interpreted as an attempt to attack the receiver.
---

In that section, to be clear, we should change:

---
Receivers should not treat reception as an
    exception, error or logged event.
---

to

---
Receivers must not treat reception as an
    exception, error or logged event.
---

Joe