Subject: RE: [seamoby-context] RE: [seamoby] Security Considerations - new wording

From: Nakhjiri Madjid-MNAKHJI1 <[email-masked]>
Date: Thu, 7 Jun 2001 15:35:40 -0500

John,
 
I agree with Gary, considering that this is only problem statement, his
mention of corrupted context transfer covers this.
In requirement draft we have a requirement on mutual authentication between
CT peers and that should cover this.
 
I think DoS is a bottomless pit and we can never get around to list every
possible DoS and protection against it in such texts.
 
Regards,
Madjid

-----Original Message-----
From: Gary Kenward [mailto:[email-masked]]
Sent: Tuesday, June 05, 2001 10:50 AM
To: [email-masked]'; [email-masked]
Cc: [email-masked]
Subject: [seamoby-context] RE: [seamoby] Security Considerations - new wording
Sensitivity: Confidential

John: 

  Good suggestions. I was actually referring to DOS and other 
similar attacks with the euphemism "transfer legitimacy". Not 
being a security guru myself, I wasn't sure if there was an 
acceptable general term, so I created one. 

  I was purposely trying to avoid being too specific in the problem 
statement. I worry that we could end up with a shopping list of 
potential threats. 

Given the direction we are going, I suspect that we will have to 
enumerate the various threats in the requirements draft anyway, as 
we are attempting to do with reliability (although, my preference 
would be to defer such a list until a proper threat analysis could 
be performed on the protocol design). Either way, the analysis will 
be done at least once, and more likely many, many times. 

Anyway, that was my thinking. Of course, if the dt wants, it can 
all be changed. Comments? 

Gary 

> -----Original Message----- 
> From: [email-masked] [ mailto:[email-masked] <mailto:[email-masked]> ] 
> Sent: Tuesday, June 05, 2001 6:01 AM 
> To: Kenward, Gary [WDLN2:AN10:EXCH]; [email-masked] 
> Cc: [email-masked]; [email-masked]; 
> [email-masked] 
> Subject: RE: [seamoby] Security Considerations - new wording 
> Sensitivity: Confidential 
> 
> 
> Hi Gary, 
> 
> I think that we need to cover DOS attacks here.  I don't 
> think we need to go into deep detail about it, but I 
> can envision some problems with CT w.r.t. DOS attacks. 
> 
> The CT protocol itself might not assume any state, but 
> if a bad guy could send context (i.e. - state) to an AR, 
> it might be able to overrun the ARs buffers.  
> 
> Alternatively, we need to ensure a third party cannot 
> re-direct context as well. 
> 
> These two subjects could fall under the 'transfer legitimacy' 
> bullet.  
> 
> So, text might be: 
> 
>       - prevention of DOS-style attacks.  Context transfer 
>       MUST NOT create any new opportunities for denial of 
>       service (DOS) attacks.  These include (but are not 
>       limited to): flooding of bogus context in order 
>       to overrun the capacity of the target node; and the 
>       redirection of context in order to prevent the 
>       successful completion of the context transfer. 
> 
> How's that? 
>       
>

---

From: Pat Calhoun <[email-masked]>
Date: Thu, 7 Jun 2001 13:51:18 -0700

> possible DoS and protection against it in such texts.

btw, all the IESG cares about is that we don't introduce new DoS possibilities,
so perhaps text along these lines would be sufficient?

PatC