Subject: [Tsvwg] Comment on:I-D ACTION:draft-ietf-tsvwg-sctpcsum-02.txt

From: [email-masked]
Date: Mon, 21 Jan 2002 13:36:07 +0200

Hi all,

I have a question & comment on the Security Considerations 

3 Security Considerations

    There may be a computational advantage in validating the Association
    against the Verification Tag prior to performing a checksum as
    invalid tags will result in the same action as a bad checksum in
    most cases. The exceptions for this technique would be INIT and some
    SHUTDOWN-COMPLETE exchanges as well as a stale COOKIE-ECHO.  These
    special case exchanges must represent small packets and will
    minimize the effect of the checksum calculation. ...

I think the above is important, but I do not understand how it relates 
to Security.

    ...   In general, 
    the security considerations of RFC2960 apply to the protocol 
    with the new checksum as well.

I think this is sufficient, as only the algorithm is changing, and
it can be thought of as just bits on the wire.

best regards,
John

_______________________________________________
tsvwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tsvwg

---

From: Randall Stewart <[email-masked]>
Date: Mon, 21 Jan 2002 07:18:03 -0600

John:

Hmm..  I too thought of this when Doug posted the original
text proposal to the WG.. 

And it is true that I don't think I would check the V-Tag
first in my implementation however there is something to the
fact that a small amount of more overhead processing as
been added to the protocol... i.e. the difference in
CPU cost of doing Adler32 and CRC32c... 

I realize this is a very small amount of difference, but
an implementor MAY want to use this fact to instead lookup
the association first and check the V-Tag before going
to the trouble of computing the CRC...

So I think it is worth mentioning...(i.e. that is why I
did not object to Doug's proposal).

R

-- 
Randall R. Stewart
[email-masked] 815-342-5222 (cell phone)