Subject: Re: [rrg] RANGER and SEAL critique

From: Tony Li <[email-masked]>
Date: Mon, 22 Feb 2010 22:09:26 -0800

> This is my attempt to write a critique of RANGER and SEAL for the
> RRG Report.  The SEAL critique is at the end.
> 
> Since there is a 500 word limit for the RRG report, I suggest
> that just the first 7 paragraphs be used.  Trying to discuss
> RANGER in any more detail quickly expands to much larger task.

I've incorporated this.

Tony

---

From: "Templin, Fred L" <[email-masked]>
Date: Thu, 25 Feb 2010 06:55:28 -0800

I'd like to have one more word on this. SEAL now has a
means for the tunnel endpoints to synchronize sequence
numbers. This is a loose synchronization (not a strict
one) because SEAL needs to account for packet loss,
reordering, etc. Also, unlike TCP, SEAL makes no
provisions for reliable delivery, because reliability
is the responsibility of higher layers.

Once synchronized, tunnel endpoints can detect and
ignore off-path spoofing attacks since it will be
difficult or impossible for an off-path attacker to
guess sequence numbers with any regularity (the
sequence numbers are long). The synchronized tunnel
endpoints can then exchange secure neighbor discovery
messages to secure the IRON-RANGER prefix registrations
and redirections.

I don't know of any other proposals that have a means
for detecting and avoiding off-path DoS attacks in
this way. Is this something that should be mentioned
in the critique or the rebuttal?

Thanks - Fred
[email-masked]

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of Tony Li
> Sent: Monday, February 22, 2010 10:09 PM
> To: Robin Whittle; RRG
> Subject: Re: [rrg] RANGER and SEAL critique
> 
> 
> 
> 
> 
> _______________________________________________
> rrg mailing list
> [email-masked]
> http://www.irtf.org/mailman/listinfo/rrg