Subject: Re: [tcpm] SYN's in draft-ietf-tcpm-tcpsecure.txt :-)

From: [email-masked] (Jerry Toporek)
Date: Wed, 19 May 2004 15:45:20 -0700

> >
> > When was it decreed that "ISS's are randomly chosen"?
> 
> I think its simply a standard practice.
> 
> http://www.computerworld.com/securitytopics/security/story/0,10801,58542,00.html

Though not a "standard", I think that RFC 1948 is a better reference
than Computerworld.

> 
> discussion came up couple of years back. Most vendors have  good random
> ISN since then. There is a detailed analysis on the web about the randomness of
> different vendors ISNs but I dont have the link handy.
> 

Yes, I'm well aware of the discussion.  For exactly the reason stated in
the original posting, completely random ISN selection is not the best
solution.

jt

_______________________________________________
tcpm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tcpm

---

From: Mitesh Dalal <[email-masked]>
Date: Wed, 19 May 2004 16:06:49 -0700 (PDT)

> Though not a "standard", I think that RFC 1948 is a better reference

I wanted to point out the time when vendors especially cisco moved to
a truly random ISN generation. 1948 predateds the article and references
a different CERT adivsory. So atleast till that time nobody had thought
of using 1948.

> the original posting, completely random ISN selection is not the best

here is the link I talked about earlier.

http://lcamtuf.coredump.cx/newtcp/

most vendors either have good 32bit randomness or have either a flawed
or acceptable 1948 implementation or none. I have nothing against 1948
nor do I  have a clue why it was not standardized. But stating that
most ISNs are randomly chosen does not sound like a misleading statement.

thx
Mitesh