Subject: Re: [pcp] Ask for your comments on PCP port-set extension

From: <[email-masked]>
Date: Wed, 4 Apr 2012 10:16:38 +0200

Hi Dan,

Your comment is valid when the same address is shared among a large number of users. A remote server may force the client to issue N connections and then discover the full port set but if the address sharing ratio is low (e.g., 2 or 4), the random port range preserves the spirit of RFC6056. 

Because address sharing ratio is deployment-specific, we need to cover the full range from 2 to 2^16.

Cheers,
Med

>-----Message d'origine-----
>De : [email-masked] [mailto:[email-masked]] De la 
>part de Dan Wing
>Envoyé : vendredi 30 mars 2012 10:30
>À : 'Qiong'; [email-masked]
>Objet : Re: [pcp] Ask for your comments on PCP port-set extension
>
>
>The Cryptographically Random Port Range Option will lead to 
>interoperability problems, and is not worth pursuing.  There is only 
>a slight gain to such pseudo-random port assignment (reference 
>RFC6056), 
>because an attacker can cause the victim to open 100's of ports to
>a server owned by the attacker, thus the attacker learns allocated
>port numbers and the port assignment algorithm (which could be 
>leveraged against other subscribers using that same algorithm at
>the same ISP).  Thus, the pseudo-random assignment of port numbers 
>does not achieve the goals outlined in RFC6056.