Subject: [rrg] Eliot's note

From: RJ Atkinson <[email-masked]>
Date: Wed, 15 Apr 2009 15:11:17 -0400

Earlier Eliot Lear wrote:
% Just a historical note on this point. When the NSRG considered
% architectural separation of identifier and locator, Steve Deering
% made the point that, particularly at layer 4, there are at least
% weaksecurity benefits from having the transport use the IP address
% as part of the pseudo-checksum.

Eliot's history is sadly incomplete in ways that truly matter...

1) A majority of the NSRG participants present, and everyone with any
    security background present, clearly disagreed with Steve Deering's
    claim at the time, speaking as someone who participated in the
    entire NSRG lifetime (unlike Eliot).

2) It is likely that the *entire* IETF Security Area disagrees
    with the claim made above; one could confidently say that
    the vast majority of the IETF Security Area disagrees with
    that claim.

Frankly, the claim is just silly.  There are *zero* security
benefits from having the transport-layer pseudo-header checksum
include the IP address.  Zip.  None.  Zero.

Yours,

Ran
[email-masked]

---

From: Dino Farinacci <[email-masked]>
Date: Wed, 15 Apr 2009 13:22:00 -0700

> include the IP address.  Zip.  None.  Zero.

I would add there are very little *other* benefits as well. Definitely  
not at the cost of unnecessary complexity implementors have to go  
through to checksum UDP messages.

Dino

---

From: Eliot Lear <[email-masked]>
Date: Wed, 15 Apr 2009 22:25:57 +0200

Regardless of what you think of Steve's point about the checksum, his 
underlying point was that there is a binding between transport and 
internet names, if ever so weak, and that if you introduce a new name 
you have to bind it securely between layers.

---

From: <[email-masked]>
Date: Wed, 15 Apr 2009 21:39:38 +0100

The benefits and tradeoffs are different for IPv6, which discards
header checksums, making the pseudo-header check more important for
reliability reasons.

Besides, shouldn't NAT be difficult?

<http://www.ee.surrey.ac.uk/Personal/L.Wood/><[email-masked]>

-----Original Message-----
From: [email-masked] on behalf of Dino Farinacci
Sent: Wed 2009-04-15 21:22
To: RJ Atkinson
Cc: IRTF Routing RG
Subject: Re: [rrg] Eliot's note

Dino

---

From: Dino Farinacci <[email-masked]>
Date: Wed, 15 Apr 2009 13:58:44 -0700

> header checksums, making the pseudo-header check more important for

Not convinced at all. If IP source or destination address bits get  
corrupted, a link-layer CRC will find it before the destination will  
ever get the packet.
> Besides, shouldn't NAT be difficult?

With enough thrust, anything can fly. Doesn't mean it should.  ;-)

Dino

---

From: RJ Atkinson <[email-masked]>
Date: Wed, 15 Apr 2009 17:09:48 -0400

> you have to bind it securely between layers.

I'll attempt a rephrase.

One of the points that various security folks have made over the years
(and that was made during NSRG days) is that millions of home NAT
boxes (all very very low cost, with low-powered/cheap innards)
have no trouble modifying that "binding" in a way that makes the
binding worthless from a security (i.e. authentication) perspective.

So:
1) An issue with the deployed Internet is that there is not always
    an easily authenticated binding between names at different layers.
    - DNSsec is part of the solution for this, as it will permit
      authentication of the bindings between IP addresses and
      FQDNs.
    - IPsec, especially AH, is another part of the solution for this.

And as a corollary:
2) It is desirable to be able to authenticate bindings between
    related names that exist at different layers.
    - DNSsec is one example of how this might be done.
    - IPsec AH is another example of how this might be done.

Cheers,

Ran

---

From: RJ Atkinson <[email-masked]>
Date: Wed, 15 Apr 2009 17:13:52 -0400

> header checksums, making the pseudo-header check more important for

There are still zero "security" benefits for IPv6.

(For my part, I would not want to claim that there are other
IPv6 benefits to including IP addresses in the pseudo-header
checksum, but the crux of the original claim was an inaccurate
one relating to "security".)

It is still trivially easy to modify the IPv6 address,
and recalculate TCP/UDP checksums to hide the
modification.

> Besides, shouldn't NAT be difficult?

It isn't difficult now, and hasn't been for years.
It is so easy that it keeps self-deploying.

Yours,

Ran

---

From: RJ Atkinson <[email-masked]>
Date: Wed, 15 Apr 2009 17:15:17 -0400

> corrupted, a link-layer CRC will find it before the destination will

And if the link checksum isn't strong enough, there will be other
serious problems anyway, so a strong enough link checksum is an
independent requirement...

So +1 on Dino's remarks on this thread...

Yours,

Ran

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 16 Apr 2009 11:06:48 +1200

> header checksums, making the pseudo-header check more important for

That's unclear to me. One of the arguments for dropping the layer 3
checksum in IPv6 is that modern layer 2 solutions come with error
detection. Making the layer 4 checksum compulsory strengthened
that argument, of course. But I don't remember discussion of
why the pseudo-header checksum is essential. In fact, when the IPNG WG
was chartered in 11/94, the charter said:

  TCP/UDP:  The IPng Working Group will specify the procedures for hosts to
  compute and verify TCP/UDP pseudo-headers.  Any other changes to TCP
  beyond making TCP work with IPng are out of scope of the working group
  and should be dealt with by a TCPng Working Group.

So it was taken for granted that we needed it.

> Besides, shouldn't NAT be difficult?

Well, no. I don't like NAT because it damages end to end connectivity.
If we fix things so that NAT doesn't damage connectivity, NAT ceases
to be a problem. Abolishing the address component of the pseudo-header
checksum would reduce the damage done by NAT. So in that sense, it
would be a move in the right direction.

   Brian

---

From: Dino Farinacci <[email-masked]>
Date: Wed, 15 Apr 2009 16:13:04 -0700

> So it was taken for granted that we needed it.

I recall the IPng directorate wanted to make the fewest changes to the  
transport layers. The only changes that were required was to lengthen  
the address and that is what turned out.

The same reason why the low-order 64-bits were not used as a socket-id  
for TCP for tcb lookups.

Dino

---

From: RJ Atkinson <[email-masked]>
Date: Thu, 16 Apr 2009 09:18:53 -0400

> The same reason why the low-order 64-bits were not used as a socket-id

All of the above is consistent with my recollections.

More is the pity, since decoupling the IPv6 addresses from
the upper-layer pseudo-header calculations would have done
IPv6 users a tremendous amount of good.

Mea culpa.  AH for IPv6 should not have included the IPv6
Routing Prefixes either (although including the IPv6 IID
would have been sensible).

Ran

---

From: Dino Farinacci <[email-masked]>
Date: Thu, 16 Apr 2009 08:42:05 -0700

> would have been sensible).

No one listened to Noel and O'Dell. Well.... I should say some people  
listened and others ...

Dino

P.S. This thread is actually productive. Because if the same sort of  
basics are ignored just a new generation of people will make similar  
mistakes. You know how the saying goes.

---

From: RJ Atkinson <[email-masked]>
Date: Thu, 16 Apr 2009 12:12:34 -0400

On  16 Apr 2009, at 11:42, Dino Farinacci wrote:
> No one listened to Noel and O'Dell. Well....
> I should say some people listened and others ...

For the record, I supported both Noel and Mike O'Dell
-- and their ideas -- long long ago.

> mistakes. You know how the saying goes.

Those who do not learn history are doomed to repeat it.

Cheers,

Ran