Subject: Re: [saag] Fwd: New Version Notification for draft-gont-numeric-ids-sec-considerations-05.txt

From: Benjamin Kaduk <[email-masked]>
Date: Wed, 18 Nov 2020 04:50:18 -0800

A (very belated) thanks for the updates, Fernando.

I think it is just about ready for IETF LC.  I do have a few notes on the
-05 (below), but am happy to have them addressed either before or after
IETF LC.

Section 3

nit: s/still fails/still fail/

I think it's probably an improvement to apply
OLD:
   A number of protocol implementations (too many of them) simply
   overlook the security and privacy implications of identifiers.
   Examples of them are the specification of TCP port numbers in
   [RFC0793], the specification of TCP sequence numbers in [RFC0793], or
   the specification of the DNS TxID in [RFC1035].

   On the other hand, there are a number of protocol specifications that
   over-specify some of their associated protocol identifiers.
   Similarly, [RFC2460] suggested the use of a global counter for the
   generation of Fragment Identification values, when the
   interoperability properties of uniqueness per {Src IP, Dst IP} could
   be achieved with other algorithms that do not result in negative
   security and privacy implications.

NEW:
   Both under-specifying and over-specifying identifier contents is
   hazardous. TCP port numbers and sequence numbers [RFC0793] and DNS TxID
   [RFC1035] were under-specified, leading to implementations that used
   predictable values and thus were vulnerable to numberous off-path
   attacks.  Over-specification, as for IPv6 Interface Identifiers (IIDs)
   [RFC4291] and Fragment Identification values [RFC2460], leaves
   implementations unable to respond to security and privacy issues
   stemming from the mandated algorithm -- IPv6 IIDs need not expose
   privacy-sensitive link-layer addresses, and predictable Fragment
   Identifiers invite the same off-path attacks that plague TCP.

Section 9.2

The [Klein2007] link seems to have gone stale; we may have to find a
different site to reference.

Thanks again,

Ben

On Thu, Jul 30, 2020 at 03:53:02AM -0300, Fernando Gont wrote:
> Hi,
> 
> We have posted a rev that means to address Benjamin's feedback. It is 
> available at: 
> https://www.ietf.org/internet-drafts/draft-gont-numeric-ids-sec-considerations-05.txt
> 
> The diff from the previous version is available at: 
> https://tools.ietf.org/rfcdiff?url2=draft-gont-numeric-ids-sec-considerations-05.txt
> 
> Thanks!
> 
> Regards,
> Fernando
> 
> 
> 
> 
> -------- Forwarded Message --------
> Subject: New Version Notification for 
> draft-gont-numeric-ids-sec-considerations-05.txt
> Date: Wed, 29 Jul 2020 23:37:54 -0700
> From: [email-masked]
> To: Fernando Gont <[email-masked]>, Ivan Arce <[email-masked]>
> 
> 
> A new version of I-D, draft-gont-numeric-ids-sec-considerations-05.txt
> has been successfully submitted by Fernando Gont and posted to the
> IETF repository.
> 
> Name:		draft-gont-numeric-ids-sec-considerations
> Revision:	05
> Title:		Security Considerations for Transient Numeric Identifiers 
> Employed in Network Protocols
> Document date:	2020-07-29
> Group:		Individual Submission
> Pages:		9
> URL: 
> https://www.ietf.org/internet-drafts/draft-gont-numeric-ids-sec-considerations-05.txt
> Status: 
> https://datatracker.ietf.org/doc/draft-gont-numeric-ids-sec-considerations/
> Htmlized: 
> https://tools.ietf.org/html/draft-gont-numeric-ids-sec-considerations-05
> Htmlized: 
> https://datatracker.ietf.org/doc/html/draft-gont-numeric-ids-sec-considerations
> Diff: 
> https://www.ietf.org/rfcdiff?url2=draft-gont-numeric-ids-sec-considerations-05
> 
> Abstract:
>     Poor selection of transient numerical identifiers in protocols such
>     as the TCP/IP suite has historically led to a number of attacks on
>     implementations, ranging from Denial of Service (DoS) to data
>     injection and information leakage that can be exploited by pervasive
>     monitoring.  To prevent such flaws in future protocols and
>     implementations, this document updates RFC 3552, requiring future
>     RFCs to contain analysis of the security and privacy properties of
>     any transient numeric identifiers specified by the protocol.
> 
>  
> 
> 
> Please note that it may take a couple of minutes from the time of submission
> until the htmlized version and diff are available at tools.ietf.org.
> 
> The IETF Secretariat
> 
> 
> 
> _______________________________________________
> saag mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/saag