Subject: RE: [MSEC] WG Last Call for RSA-signatures draft(closingdateFriday20August 2004)

From: <[email-masked]>
Date: Tue, 10 Aug 2004 15:45:07 -0400

> -----Original Message-----
> From: ext Dondeti, Lakshminath [mailto:[email-masked]]
> Sent: Tuesday, August 10, 2004 3:06 PM
> To: Sharma Atul (Nokia-ES/Boston)
> Cc: [email-masked]; [email-masked]; [email-masked]
> Subject: Re: [MSEC] WG Last Call for RSA-signatures
> draft(closingdateFriday20August 2004)
>
> Successful packet modification attacks are worse than DoS attacks.
> 

That can be one opinion for a certain domain/application. I do not
think there is a general agreed upon grading of all security
vulnerabilities, where we can say spoofing is worse than DoS.

Atul
_______________________________________________
msec mailing list
[email-masked]
http://six.pairlist.net/mailman/listinfo/msec

---

From: "Dondeti, Lakshminath" <[email-masked]>
Date: Tue, 10 Aug 2004 16:15:18 -0400

My last message in this thread.

A source auth scheme provides this property: A receiver is able to prove 
to itself that a packet received actually comes from the claimed 
sender.  Yours does not!

Lakshminath

---

From: Ken Calvert <[email-masked]>
Date: Tue, 10 Aug 2004 17:03:04 -0400 (EDT)

> I do not

I think you'll find this position a tough sell. (In other
words, I disagree, and I think others will also.)

One of the first things I try to teach my students is that
undetected faults are much worse than detected ones. It is
far better for a program to crash or fail to terminate than
for it to behave correctly but produce wrong results.

Spoofing is by definition an undetected failure, while DoS
is by definition detected or at least detectable.

KC
-- 
Ken Calvert, Associate Professor      Lab for Advanced Networking
[email-masked]                     University of Kentucky
Tel: +1.859.257.6745                 Hardymon Building, 2nd Floor
Fax: +1.859.323.1971                              301 Rose Street
http://www.cs.uky.edu/~calvert/          Lexington, KY 40506-0495