Subject: RE: [tcpm] draft-bonica and TCP segmentation

From: "Caitlin Bestler" <[email-masked]>
Date: Thu, 23 Mar 2006 14:32:22 -0800

David Borman wrote:
> On Mar 23, 2006, at 3:45 PM, Joe Touch wrote:
> 
>> 
>>> Doesn't the authentication option effectively makes a "message" out
>>> of each tcp segment, thereby requiring the 'message' boundaries to
>>> be preserved?
>> 
>> TCP considers each segment to be a message between its endpoints;
>> resegmenting those messages is a violation of the protocol.
>> Unfortunately, that's detectable only if they're protected (TCP/
>> MD5, IPsec). 
>> 
>>> MPA was specifically designed to avoid that assumption, despite the
>>> fact that assuming preservation of TCP segments on an end to end
>>> basis would have allowed signifigant design simplifications.
>> 
>> If MPA is used with a different transport protocol, that's fine.
>> 
>> If MPA is used with TCP and it allows resegmentation, all you have is
>> a protocol that protects the _data_ of TCP without protecting the
>> segments.
> 
> MPA doesn't protect anything.  It identifies record boundaries.
> 
>> 
>> Which won't protect TCP segments from attack (RST, SYN, FIN). It
>> would provide similar protection that SSL provides - perhaps
>> allowing / encouraging so-called 'transparent proxies'.
>> 
>> So MPA then protects the data in a way that is "TCP-attacker
>> friendly". That's a silly optimization IMO.
> 
> I believe the RDDP working group was explicitly told that
> they couldn't change TCP, specifically with regards to
> segmentation.  MPA sits between DDP and TCP, and no
> assumptions could be made about how TCP would segment the
> data.  MPA does not protect the data, it provides a framing
> mechanism to detect record boundaries, even when packets
> arrive out of order and the records begin in the middle of a
> TCP packet.  It was not a "silly optimization".
> 
> The TCP Enhanced Authentication Option would be part of TCP,
> and so the rules are different.  You can't compare MPA and
> the TCP Enhanced Authentication Option.
> 
> 			-David Borman

In theory that is correct. In practice, TCP Enhanced Authentication
is likely to be implemented above the layer where MPA is implemented.

As annoying as it was to define MPA *over* TCP, the reason for the
restriction was a valid desire to keep TCP simple and not cram
new bells and whistles in for upper layers. TCP Auth is exactly
that. It is a solution that meets only one need and will not be
supported in general purpose stacks because general purpose stacks
will be focusing on optimizing IPSEC and/or TLS.

Having "encryption/authentication solution du jour" is not the
way to encourage development of efficient cost-effective solutions.

_______________________________________________
tcpm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tcpm