Re: [Tsvwg] Port Randomization issues summary

[Fernando Gont <[e-mail]>]

Joe Touch wrote:

>>> 1) randomizing connection IDs helps protect against blind attacks
>>>
>>> 	- but ultimately the only way to avoid old segments
>>> 	from interfering with new connections is to keep state
>> Yes. But... what does this have to do with port randomization?
> 
> It underscores the need to keep state in the endpoints, rather than just
> trust that randomization will provide safety.

Are you talking about the vtag randomization thing you were discussiing
with Anantha?



>>> 	- randomness requires keeping more state at the endpoints
>>> 	than sequential use of the ID space
>> Why?
> 
> If IDs are used in sequence, and endpoint can keep track of "do not use"
> ones using two IDs (representing the range to be avoided). If IDs are
> used randomly, then the endpoint needs a copy of each value to avoid.

Again, I guess you msut be referring to some vtag-thing here, right?



>>> 3) randomness is costly
>>>
>>> 	as SCTP demonstrated, asserting randomness may be better
>>> 	done by referring to existing separate definitions
>> I didn't follow the recent discussion of TIME-WAIT state in SCTP, etc.
>> Could you clarify this one?
> 
> See RFC4960, sec 5.3.1., which refers off to RFC4086 to define
> randomness, rather than defining it within the SCTP spec.

Ok.

Thanks,
-- 
Fernando Gont
e-mail: [e-mail] || [e-mail]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1