Subject: Security Assessment of TCP (was: draft-gont-tcp-security)

From: Fernando Gont <[email-masked]>
Date: Mon, 13 Apr 2009 15:24:57 -0300

Hello, folks,

A few months ago there had been a thread on this list about the
publication of the UK CPNI document "Security Assessment of the
Transmission Control Protocol (TCP)" (available at:
http://www.cpni.gov.uk/Docs/tn-03-09-security-assessment-TCP.pdf).

After the publication of that document, I produced an IETF I-D version
of it, which is available at:
http://tools.ietf.org/html/draft-gont-tcp-security-00

Two possible venues for this document are tcpm and opsec. And we're
currently trying to figure out the best path forward.

One of the tcpm co-chairs (Wesley Eddy) has started a thread on this
issue (see bellow).

My personal take is that the IETF is responsible for the maintenance of
its protocols, and this effort carried ut by the UK CPNI should be
welcome, and the IETF should take the chance and benefit from this work
to publish advice on TCP security/resiliency.

Thanks!

Kind regards,
Fernando Gont

-------- Original Message --------
Subject: draft-gont-tcp-security
Date: Mon, 13 Apr 2009 09:19:43 -0500
From: Eddy, Wesley M. (GRC-RCN0)[Verizon] <[email-masked]>
To: [email-masked] <[email-masked]>
CC: Fernando Gont <[email-masked]>, Joe Abley
<[email-masked]>,        Joel Jaeggli <[email-masked]>,
 "[email-masked]" <[email-masked]>

Fernando has a draft intended for BCP, that has been discussed somewhat
on the OPSEC and IETF mailing lists:

http://tools.ietf.org/html/draft-gont-tcp-security-00

Since it concerns TCP and facets of both TCP implementation and stack
configuration, TCPM holds the most technical ability to evaluate or
work on this, in my opinion.

As I understand, Fernando is interested in having this document done
as a WG item, but hasn't gotten clear signals as to whether OPSEC or
TCPM would be more appropriate, or on the relative level of support in
the WGs to read/review/revise the material.

It is a big document, but if TCPM'ers could take a look at it and let
us know if they would support this in TCPM as a WG item, that would be
very helpful.  Or if you have other thoughts about how to handle it,
of course share those too :).

We don't really need a detailed review at this point ... just a
discussion of whether there would be support for this work to happen
in TCPM, if it's worthwhile, if it should be done somewhere else, etc.

---------------------------
Wes Eddy
Network & Systems Architect
Verizon FNS / NASA GRC
Office: (216) 433-6682
---------------------------

-- 
Fernando Gont
e-mail: [email-masked] || [email-masked]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

---

From: Lars Eggert <[email-masked]>
Date: Tue, 14 Apr 2009 15:18:06 +0300

<all hats off>

> to publish advice on TCP security/resiliency.

I agree with you, as I've already said on the TCPM list. (See my email  
there for details.)

In the interest of full disclosure, you might want to mention that you  
were one of the authors or even the main author of the CPNI document,  
at least as far as I know.

Lars

---

From: Fernando Gont <[email-masked]>
Date: Tue, 14 Apr 2009 14:51:47 -0300

> I agree with you, as I've already said on the TCPM list. (See my email

What are your thoughts about working on this I-D in the transport area?
(with hat on).

> were one of the authors or even the main author of the CPNI document, at
> least as far as I know.

Sorry, I thought this was implicit.

I am the only author of the CPNI paper (this is stated in the
"Acknowledgements" of the UK CPNI paper). For instance, that's the
reason for which I am the author of draft-gont-tcp-security.

P.S.: The only reason for which my name is not in the cover page is
simply that that is not the format with which CPNI are published. But I
thought that my authorship of the CPNI document was implicit.

Thanks,

---

From: Lars Eggert <[email-masked]>
Date: Wed, 15 Apr 2009 14:54:46 +0300

Hi,

> What are your thoughts about working on this I-D in the transport  

I believe this should be done in the transport area, because at least  
some of the techniques under consideration could be argued to not be  
fully conformant to the published TCP specs, and I want the TCP  
experts to evaluate their impact.

Lars