Subject: Re: [OPSEC] housekeeping details part one - Security Assessment of the Internet Protocol version 4

From: Joel Jaeggli <[email-masked]>
Date: Tue, 02 Dec 2008 21:07:40 -0800

Glen Kent wrote:
> Hi,
> 
> I read the draft and it is without doubt a good piece of work.
> 
> However, it makes several implementation specific recommendations,
> i.e., checks that an implementation must perform before accepting a
> fragmented packet, rate limiting IP options packets, and it goes on.
> So, the question is: Is OPSEC the right home for this draft? Are the
> members here qualified enough to make such recommendations? Isnt what
> is described here, already done by several vendors (how do you
> otherwise differentiate between different protocol implementation
> qualities), etc.?

Which comes down to documenting best practices. if it turns out that it
has become common to check a certain protocol element for spurious
values, for example checking the sequence number on tcp resets instead
of just processing them, it doesn't require that we change the protocol
in order to make (or amplify) a particular recommendation or requirement
in a previous standard.

Not all stacks are religiously conformant to begin with which is part
the reason that some variation that you see... Liberal in what you
accept and conservative in what you send isn't quite so helpful if what
you happen to accept is crap. On the other hand we have abundant
evidence of what happens when you get dangerously rigorous about
accepting to little (when someone designs devices that happen to discard
tcp ecn enabled packets because the bitfield wasn't in use when they
were created.

> Would an implementation not following one of the
> recommendations given in this draft be non-compliant (i.e. if its to
> become a proposed standard)?

I'll interpret that as a preference against ps.

> Glen
> 
>> -----Original Message-----
>> From: [email-masked] [mailto:[email-masked]]
>> On Behalf Of Joel Jaeggli
>> Sent: Friday, November 21, 2008 10.41 AM
>> To: opsec wg mailing list
>> Subject: [OPSEC] housekeeping details part one - Security
>> Assessment of the Internet Protocol version 4
>>
>> I wanted to address this while the ideas are still fresh. I
>> don't think
>> we can really call the questions till I can get at least a skeleton of
>> the minutes out and I'm only about halfway done but The major
>> questions
>> regarding:
>>
>> draft-gont-opsec-ip-security-01.txt
>>
>> are:
>>
>> Test consensus on list for accepting ip security document
>>
>> Areas for improvement in the document
>>
>> Need for cross area review
>>
>> BCP vs proposed standard
>>
>> Others?
>>
>> thanks
>> joel
>> _______________________________________________
>> OPSEC mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/opsec
>>
> 

_______________________________________________
OPSEC mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/opsec

---

From: "Glen Kent" <[email-masked]>
Date: Wed, 3 Dec 2008 22:02:57 +0530

On Wed, Dec 3, 2008 at 10:37 AM, Joel Jaeggli <[email-masked]> wrote:
Hi Joel,

> I'll interpret that as a preference against ps.

Yes, you certainly can.

Glen