Subject: Re: [NSIS] Req-Draft: Open Issue 3: Replay protection

From: Bob Braden <[email-masked]>
Date: Mon, 4 Nov 2002 17:55:48 GMT

*> From [email-masked]  Fri Nov  1 14:35:05 2002
  *> Date: Fri, 01 Nov 2002 23:33:47 +0100
  *> From: Marcus Brunner <[email-masked]>
  *> To: [email-masked]
  *> MIME-Version: 1.0
  *> Content-Transfer-Encoding: 7bit
  *> Content-Disposition: inline
  *> Content-Transfer-Encoding: 7bit
  *> Subject: [NSIS] Req-Draft: Open Issue 3: Replay protection
  *> X-BeenThere: [email-masked]
  *> X-Mailman-Version: 2.0.12
  *> List-Unsubscribe: <https://www1.ietf.org/mailman/listinfo/nsis>,
  *> 	<mailto:[email-masked]?subject=unsubscribe>
  *> List-Id: Next Steps in Signaling <nsis.ietf.org>
  *> List-Post: <mailto:[email-masked]>
  *> List-Help: <mailto:[email-masked]?subject=help>
  *> List-Subscribe: <https://www1.ietf.org/mailman/listinfo/nsis>,
  *> 	<mailto:[email-masked]?subject=subscribe>
  *> X-AntiVirus: scanned by AMaViS 0.2.1
  *> 
  *> Req-Draft: Open Issue 3: Replay protection
  *> -------------------------------
  *> 
  *> Is req 5.7.4 a MUST or SHOULD
  *> SHOULD because it is too complicated to do
  *> 

Not clear that it is too complicated... the RSVP hop/hop security
mechanism has replay protection, and the algorithm is already
documented in an RFC.

Bob Braden

  *> 5.7.4 Replay protection
  *> 
  *> To prevent replay of previous signaling messages the signaling protocol 
  *> MUST provide means to detect old i.e. already transmitted signaling 
  *> messages. A solution must cover issues of synchronization problems in the 
  *> case of a restart or a crash of a participating network element.
  *> 
  *> 
  *> --------------------------------------
  *> Dr. Marcus Brunner
  *> Network Laboratories
  *> NEC Europe Ltd.
  *> 
  *> E-Mail: [email-masked]
  *> WWW:    http://www.ccrle.nec.de/
  *> Phone: +49 (0) 6221 905 11 29
  *> personal home page: http://www.brubers.org/marcus
  *> 
  *> 
  *> _______________________________________________
  *> nsis mailing list
  *> [email-masked]
  *> https://www1.ietf.org/mailman/listinfo/nsis
  *> 
_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis

---

From: [email-masked]
Date: Tue, 5 Nov 2002 08:51:52 +0200

Hi,

> my observation is that replay protection should be classified 
> as a MUST. i
> am not aware of a protocol which suggests to classify it as a should.
> furthermore replay protection is stronly related to 
> authentication. if you
> have no guarantee of freshness then proper authentication is 
> also hard to achieve.

Agree.  Additionally, mechanisms to provide replay protection usually
are not too heavy to engineer.

John