Subject: [ipfix-protocol] UDP security

From: Stewart Bryant <[email-masked]>
Date: Fri, 18 Mar 2005 15:27:27 +0000

The security section of the protocol draft contains the following text:

"If IP address spoofing can not be prevented some level of protection
against an insertion attack is required.  With a modern implementation
of TCP with good ISN randomization [RFC1948] or SCTP insertion such
attacks are difficult without the ability to snoop the packet Flow
[RFC2960].  UDP is vulnerable to insertion attacks, however,
randomization of the initial IPFIX Sequence Number might mitigate this
problem.  In all these cases, the Sequence Number space is relatively
small giving only limited protection.  Therefore a 64 bit cookie
[L2TPv3] SHOULD be included as an element within all messages. "

It has been pointed out that we never followed this up with a
complete design for the cookie mechanism, and adding this will
cause some delay to the completion of the design.

There are 3 possible solutions:

1. add the cookie as a scope element for all records -> i.e. repeat
    the cookie multiple times in the packet.

2. use one bit from the IPFIX Message header "version" field to indicate
    whether or not a per message cookie is added -> this is not a clean
    solution

3. Change the IPFIX Message header to make it extensible such that
    it can carry per message information elements, and include the
    cookie as a per message IE -> Clean but will take time and delay
    publication of the RFC.

I don't think that we have any hard evidence that the small sequence
space used by TCP and SCTP is a serious vulnerability, and we already
have restrictions on the deployment of UDP.

I therefore propose that we delete from "UDP is ..." to the end of the
para, and add:

"UDP is vulnerable to insertion attacks, and SHOULD be protected by the
use of the address restriction mechanism described above."

We then need to remove the [L2TPv3] reference from the draft.

Stewart

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/

---

From: Nevil Brownlee <[email-masked]>
Date: Sun, 20 Mar 2005 04:11:02 +1200

> We then need to remove the [L2TPv3] reference from the draft.

I agree.

Cheers, Nevil

-----------------------------------------------------------------------
   Nevil Brownlee                 Computer Science Department | ITSS
   Phone: +64 9 373 7599 x88941           The University of Auckland
   FAX: +64 9 373 7021      Private Bag 92019, Auckland, New Zealand

-------------------------------------------------
This mail sent through University of Auckland
http://www.auckland.ac.nz/

---

From: Benoit Claise <[email-masked]>
Date: Sun, 20 Mar 2005 23:28:40 +0100

>>We then need to remove the [L2TPv3] reference from the draft.
Fine with me too.

Changes done in the next version of the draft.

Regards, Benoit.