Subject: [shara] draft-thaler-port-restricted-ip-issues: Security Considerations

From: <[email-masked]>
Date: Mon, 1 Mar 2010 11:03:27 +0100

Dear Dave, all,

You wrote in the draft: "One mitigation for security attacks against TCP is port randomization
   [I-D.ietf-tsvwg-port-randomization].  Reducing the port space
   available to host thus reduces its ability to randomize ports, and
   hence has negative security implications.  This issue would be made
   worse if there were any port sub-delegation (where sub-ranges are
   allocated out of larger ranges), since each hierarchy level would
   introduce some wasted ports."

Your statement is true for small contiguous port ranges. Nevertheless, it is more complicated to guess the port number when using ** non-contiguous ** port ranges (e.g., assign 64 contiguous port ranges using the same Port Range Mask to a given device, http://tools.ietf.org/html/draft-bajko-pripaddrassign-02#section-4.1) or with pre-allocated random port numbers as defined in http://tools.ietf.org/html/draft-bajko-pripaddrassign-02#section-5.  

More information can also be found at: http://www.ietf.org/proceedings/74/slides/shara-1/shara-1_files/v3_document.htm.

BTW, it is more complex to guess the TCP sequence number than the ports. Isn't sufficient to randomize the SN to mitigate issues listed in I-D.ietf-tsvwg-port-randomization? 

Cheers,
Med
*********************************
This message and any attachments (the "message") are confidential and intended solely for the addressees. 
Any unauthorised use or dissemination is prohibited.
Messages are susceptible to alteration. 
France Telecom Group shall not be liable for the message if altered, changed or falsified.
If you are not the intended addressee of this message, please cancel it immediately and inform the sender.
********************************

---

From: Masataka Ohta <[email-masked]>
Date: Mon, 01 Mar 2010 22:19:09 +0900

[email-masked] wrote:

> You wrote in the draft:

Which draft? I missed any announcement.

> "One mitigation for security attacks against TCP is port randomization
>    hence has negative security implications.

It is an issue only with broken protocols, only example of which is DNS.

Worse, the issue is explicitely addressed in <draft-ohta-e2e-nat-00.txt>
 
   DNS query from end hosts should be relayed by NAT gateways with
   source port number randomization to increase entropy against birthday
   attacks.

ignorance of which draft means we should better ignore Dave's draft.

Any objections?

						Masataka Ohta

---

From: <[email-masked]>
Date: Mon, 1 Mar 2010 14:29:25 +0100

-----Message d'origine-----
De : Masataka Ohta [mailto:[email-masked]] 
Envoyé : lundi 1 mars 2010 14:19
À : BOUCADAIR Mohamed NCPI/NAD/TIP
Cc : [email-masked]; [email-masked]
Objet : Re: [shara] draft-thaler-port-restricted-ip-issues: Security Considerations

Med: http://www.ietf.org/id/draft-thaler-port-restricted-ip-issues-00.txt

---

From: Masataka Ohta <[email-masked]>
Date: Tue, 02 Mar 2010 07:20:44 +0900

> Med: http://www.ietf.org/id/draft-thaler-port-restricted-ip-issues-00.txt

Thanks. As the draft says:

   This change to the IP model would be as big as, but quite different
   from, the introduction of NAT.  This issue is unique to port-

totally ignoring the fact that NAT is a form of PR-IP as was evidenced
by end to end NAT and misdirecting the discussion to anycast, I
recommend people without immunity against confusion not to read it.

Leagacy NAT is PR-IP with dynamic port number assignment. It is not
end to end, because a NAT box act as an end host (with modified
stack) to the Internet and as a proxy to real end hosts (without
modified stack) in a private network.

The draft is an abstract nonsense.

PR-IP does restrict ports and requires host (and network equipments
near host) changes. That's all.

							Masataka Ohta