Subject: Re: [tcpinc] TCP-ENO - simultaneous open support

From: "Everhart, Craig" <[email-masked]>
Date: Thu, 19 Nov 2015 22:39:27 +0000

Should tcpinc support TCP simultaneous open?  No.

David reminds us that the WG charter does not require support for ³all
connections.²  Support for TCP-SO is complex and error prone, and at the
same time my corner of the ³real world² doesn¹t need or use it.  I¹ll
assert without proof that the vast majority of connections that I know
about are initiated asymmetrically.

		Craig

On 11/19/15, 1:42 PM, "Tcpinc on behalf of Black, David"
<[email-masked] on behalf of [email-masked]> wrote:

>Everyone,
>
>The discussion on protocol asymmetry has focused on tcpcrypt.  While
>that discussion has been interesting and useful, the chairs believe
>that the WG should figure out how TCP Simultaneous Open (TCP-SO)
>interacts with the TCP Encryption Negotiation Option (TCP-ENO), as
>that's where TCP-SO first impacts tcpinc.
>
>There will be at least one tcpinc asymmetric security protocol
>(distinct A/B, client/server, passive/active opener or whatever
>roles) as TLS is inherently asymmetric, independent of whether
>tcpcrypt is modified to be symmetric (and the chairs also do
>not currently see WG rough consensus for such a modification
>to tcpcrypt).
>
>Hence the initial focus needs to be on how TCP-ENO functions when
>sandwiched between TCP-SO and an asymmetric tcpinc security protocol.
>The starting point for this is the TCP-SO discussion in the TCP-ENO
>draft:
>
>https://tools.ietf.org/html/draft-ietf-tcpinc-tcpeno-00#section-6.2
>
>TCP-SO is detectable at runtime - SYN sent followed by SYN received
>for the same connection causes a TCP connection state machine
>transition that is unique to TCP simultaneous open.  More background
>on TCP-SO (and its interaction with NATs) can be found in sections
>4.2 and 4.3 of RFC 5382:
>        https://datatracker.ietf.org/doc/rfc5382/
>
>The first topic is what to do about tcpinc encryption when that
>detection happens, starting with:
>
>- Should tcpinc support TCP simultaneous open?  Yes or No
>
>If the WG's answer to that is "No", the next question will be
>whether tcpinc should abandon a TCP-SO connection attempt vs.
>proceed unencrypted, so it will be helpful for comments that
>advocate a "No" answer to express a preference on what to do
>when TCP-SO is detected.
>
>If the answer is "Yes," discussion will proceed into options like
>those listed in Section 6.2 of the TCP-ENO draft, but the chairs
>would like to get to WG rough consensus on TCP-SO support first.
>
>The chairs have seen some concern expressed that a "No" answer might
>get veto-ed by the larger Transport Area or the IETF as a whole.
>We ask WG participants to set aside this possible veto for the
>purpose of discussion because:
>
>1) The right technical answer is the preferred starting point
>        in the IETF.
>
>2) The WG charter says that our goal is "to provide reasonable
>        security for the majority of connections."  It does not
>        say "all connections."  We already know that some connections
>        are unworkable - e.g., tcpinc integrity protection is
>        incompatible with NAT traversal via a protocol-specific
>        NAT-resident ALG (e.g., as used for FTP).
>
>3) The WG chairs intend to take the WG rough consensus on this
>        topic and vet it with at least the Transport and ART Areas
>        to see what transpires.  Any resulting discussion will have
>        a technical foundation and be visible to the WG.
>
>WG rough consensus on the right technical answer is the first
>step towards making progress here.
>
>So please comment on:
>
>- Should tcpinc support TCP simultaneous open?  Yes or No
>-- If "No," should TCP simultaneous open connection attempts
>     be abandoned or proceed unencrypted?
>
>Thanks,
>--David & Kyle (in Mirja's absence)
>
>----------------------------------------------------
>David L. Black, Distinguished Engineer
>EMC Corporation, 176 South St., Hopkinton, MA  01748
>+1 (508) 293-7953             FAX: +1 (508) 293-7786
>[email-masked]        Mobile: +1 (978) 394-7754
>----------------------------------------------------
>
>
>_______________________________________________
>Tcpinc mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/tcpinc