Subject: Re: [tcpinc] WGLC for draft-ietf-tcpinc-tcpcrypt

From: "Black, David" <[email-masked]>
Date: Thu, 16 Feb 2017 00:29:45 +0000

I focused on the changes since the -03 version, and found this sentence in Section 3.7:

   When the TCP FIN flag differs
   from "FINp", a receiving host MUST either ignore the segment
   altogether or abort the connection and raise an error condition
   distinct from the end-of-file condition.

I believe that this is ok, although I suggest adding a short explanation of why this is not a new denial-of-service exposure to the Security Considerations section.  In essence, this check blocks off-path injection of FIN, as the off-path attacker cannot generate valid tcpcrypt content, so the packet should be dropped before getting to this header flag processing, and the situation for an on-path attacker is no worse, as in tcpcrypt’s absence, the injected FIN would close the connection.

Thanks, --David

From: Tcpinc [mailto:[email-masked]] On Behalf Of Kyle Rose
Sent: Monday, January 23, 2017 6:16 PM
To: tcpinc
Subject: [tcpinc] WGLC for draft-ietf-tcpinc-tcpcrypt

This is a working group last call for the "Cryptographic protection of TCP Streams (tcpcrypt)" draft available at https://datatracker.ietf.org/doc/draft-ietf-tcpinc-tcpcrypt/. Please review the document and send your comments to the list by 2017-February-15.
- Kyle and David