Subject: [NSIS] Input to the Threats & Security Properities document

From: [email-masked]
Date: Wed, 21 Apr 2004 14:53:48 +0300

Hi all,

I have been discussing with our ADs about progressing the Threats documents.  In summary, we need
to get it completed as soon as possible.

Security threats should be presented clearly and provide an answer to Steve's question on the Framework.  
Framework can point to the threats document.  If we cannot provide complete answers to Steve's
questions, then we should point out that they are hard problems which need solving.

thanks,
John

_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis

---

From: "Hancock, Robert" <[email-masked]>
Date: Thu, 22 Apr 2004 21:44:45 +0100

hi,

Steve's comments basically relate to the problem of flooding
the processing capabilities of interior nodes with signalling
messages.

The next threats document will contain a discussion of the
flooding problem in some detail (text already posted). The
framework notes specifically the necessity of DoS-resistance
of the NTLP, and in addition refers (normatively, in fact)
to the threats document.

There are clearly many things one can do in the protocol 
development to mitigate this threat. However, I don't believe
they can usefully be described in the framework without 
including a lot of other information about NTLP design options
which the framework deliberately leaves open (indeed, in the
past there has been strenuous objection from within the WG 
to including such information). The information should go in 
the protocol designs.

Under these circumstances, I don't at the moment see what
should usefully be added in the framework itself. If people
think there is stuff to be added, or that the existing stuff
could be explained better, please speak up. (There will be
an update to address some comprehensibility issues anyway.)

cheers,

r.

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> Sent: Wednesday, April 21, 2004 13:54
> To: [email-masked]; Hancock, Robert; [email-masked]
> Subject: Input to the Threats & Security Properities document
> 
> 
> Hi all,
> 
> Security threats should be presented clearly and provide an 
> answer to Steve's question on the Framework.