Subject: [conex] Stephen Farrell's No Objection on draft-ietf-conex-tcp-modifications-09: (with COMMENT)

From: "Stephen Farrell" <[email-masked]>
Date: Thu, 01 Oct 2015 04:56:19 -0700

Stephen Farrell has entered the following ballot position for
draft-ietf-conex-tcp-modifications-09: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-conex-tcp-modifications/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Seems like a fine thing to experiment with. I hope the results
are interesting.

The security considerations really ought take into account or at
least mention potential misbehaviour by middleboxes and also how
conex might be affected by DoS attacks.

---

From: Mirja Kühlewind <[email-masked]>
Date: Fri, 9 Oct 2015 11:43:55 +0200

Hi Stephan,

quick reply to you comment below. The two points below are discussed in 
draft-ietf-conex-destopt as ConEx is signaled in the IP layer and the attacks 
would (from my point of view) only interfere with the signaling (and not any 
additional algorithms that are used in TCP to decide when to set a marking).

draft-ietf-conex-destopt even has an own section on "Mitigating flooding 
attacks by using preferential drop". I guess that's what you've been looking 
for, right?

Further, draft-ietf-conex-destopt says in the security section that IPsec AH 
can be used to detect changes to ConEx information. Actually it does not say 
what to do if such changes are detected. I'll check with my co-authors if we 
can add some more information here.

Regarding draft-ietf-conex-tcp-modifications, I've added two sentences at the 
beginning of the security section to say that these issues are discussed in 
draft-ietf-conex-destopt. Is that okay for you?

Mirja

---

From: Stephen Farrell <[email-masked]>
Date: Fri, 9 Oct 2015 12:07:18 +0100

On 09/10/15 10:43, Mirja Kühlewind wrote:
> draft-ietf-conex-destopt as ConEx is signaled in the IP layer and the
> attacks would (from my point of view) only interfere with the signaling
> (and not any additional algorithms that are used in TCP to decide when
> to set a marking).
> 
> attacks by using preferential drop". I guess that's what you've been
> looking for, right?
> 
> Further, draft-ietf-conex-destopt says in the security section that
> IPsec AH can be used to detect changes to ConEx information. Actually it
> does not say what to do if such changes are detected. I'll check with my
> co-authors if we can add some more information here.
> 
> Regarding draft-ietf-conex-tcp-modifications, I've added two sentences
> at the beginning of the security section to say that these issues are
> discussed in draft-ietf-conex-destopt. Is that okay for you?

Seems good, thanks,
S.