Subject: [tcpm] RE: TCP secure

From: "Anantha Ramaiah (ananth)" <[email-masked]>
Date: Tue, 8 Jan 2008 08:37:20 -0800

More latest developments on this. Since the draft was expiring on Jan
9th, I had to post a new version to renew the draft which should show up
in the usual places very soon. This version has :-

- The Applicability statement in place (section 1.1) 
- Alfred Hoenes had some editorial comments on the previous version,
incorporated them.

You can use the AS in the draft as a reference for discussions
pertaining to the same.

Thanks,
Anantha

> -----Original Message-----
> From: Anantha Ramaiah (ananth) 
> Sent: Thursday, January 03, 2008 1:06 PM
> To: TCP Maintenance and Minor Extensions WG
> Cc: [email-masked]'; Ted Faber
> Subject: TCP secure 
> 
> Greetings,
>        
> The following note pertains to the TCP secure document and 
> the hope is to get this to WGLC once the pending issues are resolved.
> 
> Summary
> =======
> 
> After the presentation in the Chicago IETF and the follow up 
> discussions on the mailing list w.r.t the strength of the 
> mitigations, the outcome of which was to have an 
> applicability statement and then go about getting consensus 
> on the strength of each individual mitigation. To quote Mark Allman :
> 
> <BEGIN QUOTE>
> 
>   It seems to me that this discussion is really divergent 
> because there
>   is no applicability statement in the document, per Lars' comment.  I
>   wonder if you guys could go off and generate such a 
> statement and then
>   we could re-visit this question.  I think that would factor things
>   into a question of "where" this is applicable and then how 
> strongly we
>   want to advocate these mitigations within that context.  Is that
>   reasonable?
> 
> <END QUOTE>
> 
> There was a discussion in which some folks mentioned how the 
> AS should be structured. We have attempted to capture this 
> and what follows is the sample AS.
> 
> ==============================================================
> ========================
> APPLICABILITY STATEMENT
> 
> The mitigations presented in this document talks about some 
> known in-window attacks and the solutions to the same. The 
> mitigations suggested in this draft SHOULD (RECOMMENDED) be 
> implemented in devices where the TCP connections are most 
> vulnerable to the attacks described in this document.  Some 
> examples of such TCP connections are the ones that tend to be 
> long-lived where the connection end points can be determined, 
> in cases where no auxiliary anti-spoofing protection 
> mechanisms like TCP MD5 can be deployed. TCP secure MAY 
> (OPTIONAL) be implemented in other cases. 
> ==============================================================
> ==========================
> 
> It would be nicer if folks can comment on the 
> 
> A) AS and suggest any modifications.
> 
> B) choose the strength of each mitigation WITH reasoning.
> 
> 
> My vote
> =======
> 
> Since AS covers the main concern, my vote would go for all 
> MUST's or SHOULD's.
> 
> Reason for picking MUST's or SHOULD's : 
> 
> With AS in place, the document has given enough leeway for 
> implementers to pick and chose whether one wants to implement 
> TCP secure or not. These mitigations are important since it 
> increases TCP's robustness to various attacks described in 
> the document. Hence I would color them as MUST's or SHOULD's.
> 
> Thanks,
> Anantha
> 

_______________________________________________
tcpm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tcpm