Subject: RE: [Tsvwg] Re: [tcpm] Revision of draft-larsen-tsvwg-port-randomization

From: "Dan Wing" <[email-masked]>
Date: Fri, 1 Jun 2007 15:38:33 -0700

Lars Eggert [mailto:[email-masked]] wrote:
> On 2007-2-11, at 17:56, ext Fernando Gont wrote:
> > We have published a revision of the port randomization draft
> > (draft-larsen-tsvwg-port-randomization). This version addresses
> > feedback from Alfred Hoenes and Carlos Pignataro, and comments from
> > FreeBSD's Mike Silbersack. The draft is targetted at tsvwg because
> > the same stuff can be applied to other protocols. But most (all?) of
> > the work on this has been done mainly for TCP.
> 
> The update is at http://tools.ietf.org/html/draft-larsen-tsvwg-port- 
> randomization.
> 
> The concepts in this draft are likely relevant to most of our  
> transport protocols, and hence would be in scope for TSVWG. 
> The TSVWG  
> chairs are interested in comments on whether there is group interest  
> in this draft - please comment on [email-masked].

The suggestions in this document are equally important for RTP 
so that attackers are forced to work harder to inject undesired
content into RTP media sessions.  It would be useful if the 
document scope were expanded slightly to explicitly include RTP.  
For example, the Abstract currently says:

   Recently, awareness has been raised about a number of "blind" attacks
   that can be performed against the Transmission Control Protocol (TCP)
   and similar protocols.

it is hard to say that RTP is similar to TCP.  Thus, I would suggest
changing it to something like this:

   Recently, awareness has been raised about a number of "blind" attacks
   that can be performed against protocols that reuse ports such as 
   Transmission Control Protocol (TCP) and Real-time Transport 
   Protocol (RTP).

with a similar change in the Introduction.

Even without this change, I support adopting this document as a TSVWG item.

-d

---

From: Fernando Gont <[email-masked]>
Date: Wed, 06 Jun 2007 10:08:58 -0300

>document scope were expanded slightly to explicitly include RTP.
[....]

Will do.

>Even without this change, I support adopting this document as a TSVWG item.

Thanks so much!

Kindest regards,

--
Fernando Gont
e-mail: [email-masked] || [email-masked]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

---

From: Gorry Fairhurst <[email-masked]>
Date: Mon, 11 Jun 2007 08:43:42 +0100

> The concepts in this draft are likely relevant to most of
 > our  transport protocols, and hence would be in scope for TSVWG.

 > The TSVWG  chairs are interested in comments on whether there is
 > group interest  in this draft - please comment on [email-masked].
 > I've read the previous revision of the draft, and will read the
 > current one soon.

I have read and commented on previous versions (and will read the 
current).

I agree the concepts are applicable to transports such as DCCP, and the 
concept is sufficiently simple that it could probably be done for all 
transports...

I think tsvwg could be the right place - as long as there's 
cross-communication with SCTP, TCP, DCCP, etc. As someone already noted, 
this really also needs visibility with people USING transport, RTP, 
apps, signalling, etc.
I support adopting this document as a TSVWG item.

Gorry

Lars Eggert wrote:

> The concepts in this draft are likely relevant to most of our  transport 
> protocols, and hence would be in scope for TSVWG. The TSVWG  chairs are 
> interested in comments on whether there is group interest  in this draft 
> - please comment on [email-masked].
> 
> Lars
> 
>