Subject: [BEHAVE] draft-donley-behave-deterministic-cgn-08.txt

From: 🔓Dan Wing <[email-masked]>
Date: Thu, 2 Oct 2014 18:16:33 -0700

I see draft-donley-behave-deterministic-cgn was updated to -08.  Unchanged from -07 is this statement in its Security Considerations:

   Note that with the possible exception of cryptographically-based port
   allocations, attackers could reverse-engineer algorithmically-derived
   port allocations to either target a specific subscriber or to spoof
   traffic to make it appear to have been generated by a specific
   subscriber.  However, this is **exactly** the same level of security that
   the subscriber would experience in the absence of CGN.

Emphasis on "exactly" is mine.  I am puzzled by this still being "exactly" when the draft itself cites RFC6056, 

   There are trade-offs to be made between
   the sizes of these port groups, the ratio of public addresses to
   subscribers, whether or not these groups timeout, and the impact on
   logging requirements and port randomization security (RFC6056) [RFC6056]."

A 4000-port range (as used in the example) with overflow is not exactly the same security exposure as 65355 ports -- and RFC6056 says so, https://tools.ietf.org/html/rfc6056#page-9:

   It is also worth noting that, provided adequate algorithms are in
   use, the larger the range from which ephemeral ports are selected,
   the smaller the chances of an attacker are to guess the selected port
   number.

draft-donley-behave-deterministic-cgn would be improved by making it clear, in its security considerations, that the reduced port range is a harm to end host security.  I suggest:

  By reducing the ephemeral port numbers available to hosts behind a CGN, those hosts are subject to an increased attack surface [RFC6056].

-d