Subject: Re: [lisp] Gleaning and research assumptions

From: [email-masked] (Noel Chiappa)
Date: Tue, 8 Dec 2009 21:00:17 -0500 (EST)

{Ooops, previously sent to wrong list with wrong Subject:}

    > From: Sam Hartman <[email-masked]>

    > I'm talking about the map reply record in a map request
    > ...
    > My personal opinion is that you can only use that record to establish a
    > new reverse mapping entry when it does travel the mapping system and
    > only if the mapping system is changed to modify it.

Well, this is a complex topic. E.g. if it is signed in some way, you could in
fact rely on it. You can also use it in a 'temporary' way while you look up
the mapping authoritatively. Etc, etc.

        Noel

---

From: Sam Hartman <[email-masked]>
Date: Wed, 09 Dec 2009 10:02:30 -0500

>>>>> "Noel" == Noel Chiappa <[email-masked]> writes:

    Noel> {Ooops, previously sent to wrong list with wrong Subject:}

    >> I'm talking about the map reply record in a map request ...  My
    >> personal opinion is that you can only use that record to
    >> establish a new reverse mapping entry when it does travel the
    >> mapping system and only if the mapping system is changed to
    >> modify it.

    Noel> Well, this is a complex topic. E.g. if it is signed in some
    Noel> way, you could in fact rely on it. 

If you do the appropriate verification yes.
My suspicion is that we're not going to want to push that out to ITRs as
I discuss on the wiki.

    Noel> You can also use it in a
    Noel> 'temporary' way while you look up the mapping
    Noel> authoritatively. Etc, etc.

No, I don't think this is acceptable for the Internet at all.  There are
a number of attacks, like TCP sequence guessing etc, that are made
significantly easier by being part of a topology for one or two packet
exchanges.  So, I don't believe that having mappings supplied by an
attacker in place while you verify them is consistent with the goal of
not making the security of the Internet worse.