[tsvwg] Request for consensus call for Auth in UDP options

[Tom Herbert <[e-mail]>]

TSVWG chairs,

I have raised an objection to the UDP Options draft that the
Authentication may be ignored by a receiver. I believe this is a
serious security vulnerability in the protocol.

If a sender uses the option that must mean that a key negotiation must
have happened, so when the sender places the option in a packet they
naturally have the full expectation that the receiver will validate
the authentication credentials. If the receiver elects to ignore the
authentication then they will not only allow legitimate senders but an
attacker will be able to access the system as well-- so basically
there is no security and the user is at risk for harm. Ignoring an
authentication option is not safe.

The counter argument seems to be that it should be up to the receiver
to decide if the authentication option must be validated. That stands
in contrast to other authentication protocols like IPv6 AH that
explicitly require authentication option to be validated if it is
present (if they can't validate, then the packet MUST be dropped). If
the idea is that the user decides this then security is wholly
dependent on the user configuring the protocol correctly, so a slight
misconfiguration could allow a major breach (note this cannot happen
in IPv6 AH).

Please consider doing a consensus call on whether ignoring an
Authentication option in UDP options is allowed.

Thanks,
Tom