Subject: [Sigtran] question on draft-ietf-sigtran-security-03.txt

From: "Poetzl, Joachim" <[email-masked]>
Date: Wed, 10 Dec 2003 14:55:00 +0100

Hi Folks,

I´ve got a question on draft Security Considerations for SIGTRAN Protocols (draft-ietf-sigtran-security-03.txt).

In chapter 6 "TLS Usage" the following statement has been made:

--snip

Because TLS only protects the payload the SCTP header and all control chunks are not protected. This can be used for DoS attacks. This is a general problem with security provided at the transport layer.

snap--

Maybe my question comes from a lack of understanding about TLS, but how can there a destiction been made between SCTP-data chunks (User adaption layer payload) and SCTP-control chunks? In my understanding both are considered being SCTP-Payload.

Can someone help on that?

> Best Regards
> Joachim Pötzl
Deutsche Telekom AG
T-Com Zentrale
T332-4; Signalling, Gateways and Switching Systems
64307 DARMSTADT, GERMANY 
Phone:  +49 6151 83-2134
Fax:      +49 6151 83-4577
PCFax:  +49 521 52244 983
> mailto:[email-masked] 
> 

_______________________________________________
Sigtran mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/sigtran

---

From: Michael Tuexen <[email-masked]>
Date: Sat, 13 Dec 2003 10:47:24 +0100

Joachim,
see my comments below.
Best regards
Michael
On Dec 10, 2003, at 2:55 PM, Poetzl, Joachim wrote:

> Hi Folks,
>
> I´ve got a question on draft Security Considerations for SIGTRAN 
> Protocols (draft-ietf-sigtran-security-03.txt).
>
> Because TLS only protects the payload the SCTP header and all control 
> chunks are not protected. This can be used for DoS attacks. This is a 
> general problem with security provided at the transport layer.
>
> snap--
>
> Maybe my question comes from a lack of understanding about TLS, but 
> how can there a destiction been made between SCTP-data chunks (User 
> adaption layer payload) and SCTP-control chunks? In my understanding 
> both are considered being SCTP-Payload.
>
You are wrong here. SCTP has two classes of chunks: DATA chunks 
carrying user data
and control chunks used for exchanging SCTP control information. 
Therefore upper
layer information is transported only in DATA chunks. TLS is an upper 
layer of SCTP
and therefore is only carried in DATA chunks and, of course, can only 
protect its
upper layer.
I hope this clarifies the statement in the security document.