Subject: [tcpm] Question about the path of tcpsecure and ICMP attacks

From: Fernando Gont <[email-masked]>
Date: Fri, 14 Jul 2006 06:51:54 -0300

Folks,

Recent discussion on the tcpsecure draft has made me think (again) 
about the path of the tcpsecure and the ICMP attacks draft.

tcpsecure is meant for standards track, while the ICMP attacks draft 
is meant for Informational.

tcpsecure aims to address, among others, blind connection-reset 
attacks, which require an attacker to spoof a segment that contains 
the  four-tuple that identifies the connection *only* is "in window". 
Source IP address spoofing is necessary.

icmp-attacks aims to address, among others, blind connection-reset 
attacks, which *only* requires the attacker to spoof a packet that 
contains the four-tuple that identifies the connection to be 
attacked. Source IP address spoofing is not necessary.

As Joe pointed out, it's clear that if you bother to mitigate 
(TCP-based) in-window attacks, you will first (or "also", if you 
want) mitigate the ICMP-based ones, for which the TCP sequence number 
does not matter at all.

However, with the current path that each document has, the 
specifications would end up fixed for the "in window" (TCP-based) 
attacks, but not for the more simple ICMP-based counterpart.

A number of folks have mentioned that they would like the specs fixed 
wrt the ICMP attacks. But the path of the ICMP attacks draft is still 
Informational (as decided in IETF 64).

I'll be working on the next revision of the ICMP attacks anytime 
soon. Among all the feedback there is to address, there's that of 
rephrasing the text that was originally in RFC2119-speak (as the 
draft is currently meant for Informational).

Therefore, it would be useful to make that of which path the ICMP 
attacks draft aims to, so that I don't go back and forth with the 
text that makes the draft prescriptive.

Kindest regards,

--
Fernando Gont
e-mail: [email-masked] || [email-masked]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

_______________________________________________
tcpm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tcpm