Subject: Re: [tcpm] SYN's in draft-ietf-tcpm-tcpsecure.txt :-)

From: [email-masked] (Jerry Toporek)
Date: Wed, 19 May 2004 12:46:49 -0700

> 
> But now that the ISS's are randomly chosen, you've got a
> (windowsize/(2**32)) chance of the old SYN being within the window of
> the new connection (less chance if successive connection attempts are
> delayed by a long-ish time to let old SYN packets die).
> 

When was it decreed that "ISS's are randomly chosen"?

One of the strengths of the preferred mechanism for ISS selection
(described in RFC 1948) is that it maintains exactly the same
traditional time-based increase of ISS *on a per-source/dest-pair
basis*, while hiding any useful information from a blind attacker.

jt

_______________________________________________
tcpm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tcpm

---

From: Mitesh Dalal <[email-masked]>
Date: Wed, 19 May 2004 14:23:48 -0700 (PDT)

> When was it decreed that "ISS's are randomly chosen"?

I think its simply a standard practice.

http://www.computerworld.com/securitytopics/security/story/0,10801,58542,00.html

discussion came up couple of years back. Most vendors have  good random
ISN since then. There is a detailed analysis on the web about the randomness of
different vendors ISNs but I dont have the link handy.

Mitesh