Subject: [tcpm] FW: New Version Notification for draft-ietf-tcpm-1323bis-20.txt

From: "Scheffenegger, Richard" <[email-masked]>
Date: Mon, 3 Mar 2014 23:39:45 +0000

Hi,

during the SecDir review, a minor omission was found in the security section. As the actual concern has been described sufficiently in other sections of the draft, the change is referencing the relevant section, and addressing the inaccuracies in the wording.

The new security section now reads as follows (initial paragraphs only, changed lines marked with "+"):

> 7.  Security Considerations
> 
>   The TCP sequence space is a fixed size, and as the window becomes
>   larger it becomes easier for an attacker to generate forged packets
>   that can fall within the TCP window, and be accepted as valid
>   segments.  While use of timestamps and PAWS can help to mitigate
>   this, when using PAWS, if an attacker is able to forge a packet that
>   is acceptable to the TCP connection, a timestamp that is in the
>   future would cause valid segments to be dropped due to PAWS checks.
>   Hence, implementers should take care to not open the TCP window
>   drastically beyond the requirements of the connection.
> 
> +  See [RFC5961] for mitigation strategies to blind in-window attacks.
> 
>   A naive implementation that derives the timestamp clock value
>   directly from a system uptime clock may unintentionally leak this
>   information to an attacker.  This does not directly compromise any of
>   the mechanisms described in this document.  However, this may be
> +  valuable information to a potential attacker.  It is therefore  
> + RECOMMENDED to generate a random, per-connection offset to be used  
> + with the clock source when generating the Timestamps option value  
> + (see Section 5.4).
> 
> [...]

Richard Scheffenegger

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Montag, 03. März 2014 23:35
To: David Borman; Scheffenegger, Richard; Scheffenegger, Richard; David Borman; Van Jacobson; Van Jacobson; Bob Braden; Robert T. Braden
Subject: New Version Notification for draft-ietf-tcpm-1323bis-20.txt

A new version of I-D, draft-ietf-tcpm-1323bis-20.txt has been successfully submitted by Richard Scheffenegger and posted to the IETF repository.

Name:		draft-ietf-tcpm-1323bis
Revision:	20
Title:		TCP Extensions for High Performance
Document date:	2014-03-04
Group:		tcpm
Pages:		49
URL:            http://www.ietf.org/internet-drafts/draft-ietf-tcpm-1323bis-20.txt
Status:         https://datatracker.ietf.org/doc/draft-ietf-tcpm-1323bis/
Htmlized:       http://tools.ietf.org/html/draft-ietf-tcpm-1323bis-20
Diff:           http://www.ietf.org/rfcdiff?url2=draft-ietf-tcpm-1323bis-20

Abstract:
   This document specifies a set of TCP extensions to improve
   performance over paths with a large bandwidth * delay product and to
   provide reliable operation over very high-speed paths.  It defines
   the TCP Window Scale (WS) option and the TCP Timestamps (TS) option
   and their semantics.  The Window Scale option is used to support
   larger receive windows, while the Timestamps option can be used for
   at least two distinct mechanisms, PAWS (Protection Against Wrapped
   Sequences) and RTTM (Round Trip Time Measurement), that are also
   described herein.

   This document obsoletes RFC1323 and describes changes from it.

Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat