Subject: Re: [tcpm] Request for feedback on WG adoptionof draft-cheng-tcpm-fastopen-00

From: "SCHARF, Michael" <[email-masked]>
Date: Mon, 1 Aug 2011 11:18:17 +0200

Please find two comments inline

> On 7/27/11 1:01 PM, SCHARF, Michael wrote:
> > In order to determine the WG consensus, the chairs ask for 
> additional 
> > feedback on that draft. Please provide feedback whether you 
> find this 
> > draft useful or not, and whether you think that it should 
> become a WG 
> > item.
> >
> Please note that I've previously stated that this is a really 
> bad idea!
> 
> I was so irritated by this idea that I publicly posted an 
> alternative (that had been privately baking for some time).  
> It was forwarded to be published as Experimental some time 
> ago -- still awaiting IESG review.
>
> I don't know how/why this was reconsidered at yet another 
> meeting, as there were no updates fixing anything that was 
> raised previously.  Most conferences (or working groups) 
> don't allow multiple presentations of the same paper.

Well, the presentation apparently contains new material, as requested by
the TCPM chairs.
 
> > Also, please let us know if there should be technical 
> issues that are 
> > not addressed so far by the draft and that would require further 
> > discussion or analysis.
> >
> I could re-post my objections again, but really it boils down to:
> 
> 1) insecure, demonstrates very poor knowledge of security principles.
> 
> 2) doesn't work with commonly deployed middleboxen, degrades badly.

It would help to technically substantiate these claims.

draft-cheng-tcpm-fastopen-00 already explains some security issues and
potential counter-measures. And if I correctly understand Michio Honda's
comment during the TCPM meeting, his measurements don't  confirm the
second statement (but I have not seen these results and thus I might be
wrong).

Michael
(TCPM co-chair)

---

From: William Allen Simpson <[email-masked]>
Date: Mon, 01 Aug 2011 11:27:45 -0400

> Well, the presentation apparently contains new material, as requested by
Ah, well then, perhaps they should publish the presentation as an RFC.

Because really, presentations and going to conferences are what protocol
designing is all about. :-(

> It would help to technically substantiate these claims.
When I have more time, I'll re-post them again later.

> second statement (but I have not seen these results and thus I might be
Since Cisco has likely sold a million (or more) ASA firewalls, I simply
don't believe his measurements! :-(

Since Cisco EoL'd it, and service contracts ended May 15, 2011, don't
expect any more updates.  Folks I've corresponded with haven't even
deployed earlier updates, so we really shouldn't have high expectations.

And that's just the most prevalent product.  There seem to be plenty of
others I've not successfully identified....  If I can find this stuff as
an individual with just a few simple probes of the 'net and checking
operations lists, I wonder how much effort this huge company put into
testing, and/or what they've been smoking.

Moreover, I told some of these folks at Google back in late January-early
February of 2010 that their ideas wouldn't work, and added the (ab)use of
Sack in TCPCT for them.  I wish I'd charged them for wasting my time.
[heavy sigh]