Subject: [Tsvwg] WGLC for draft-ietf-tsvwg-sctpthreat-01 starts NOW

From: "James M. Polk" <[email-masked]>
Date: Sun, 15 Oct 2006 03:04:55 -0500

TSVWG Group

The WGLC for SCTP Threats as an INFO document

http://www.ietf.org/internet-drafts/draft-ietf-tsvwg-sctpthreat-01.txt

starts NOW.

All comments (nits, errors, suggestions, comments, approval) regarding this 
ID should be directed to the TSVWG list.

WGLC will end on or about October 30th, 2006, depending on the level of 
discussion at that time.

cheers,

James
Lars
Magnus
	IETF TSVWG co-chairs

---

From: "Brian F. G. Bidulock" <[email-masked]>
Date: Sun, 15 Oct 2006 03:57:03 -0600

James,

One big nit.

The document is written referring to the SCTP-IG (which is not in the
references) and even Version 10 of the SCTP-IG (which is also not in
the references).  I believe the SCTP-IG has become RFC 4460 and the
draft should be rewritten to reference RFC 4460 instead of the SCTP-IG.

It is difficult to review the draft while it refers so heavily to
unreferenced outdated versions of the SCTP-IG drafts.

Could the document be updated to refer appropriately to RFC 4460 and
resubmitted before it is reviewed?

--brian

James M. Polk wrote:                               (Sun, 15 Oct 2006 03:04:55)

-- 
Brian F. G. Bidulock
[email-masked]
http://www.openss7.org/

---

From: "Brian F. G. Bidulock" <[email-masked]>
Date: Sun, 15 Oct 2006 05:02:39 -0600

Annother comment (well, questions) on this:  This draft looks like it
should be the security section of the other draft at WGLC: 2960bis.  Why
is not this entire draft imported into the security section of 2960bis?
As as a separate INFO RFC, it will leave the DS security section lacking.
Or was it the intention to have 2960bis refer to this info RFC from its
security section?

--brian

-- 
Brian F. G. Bidulock
[email-masked]
http://www.openss7.org/

---

From: Michael Tuexen <[email-masked]>
Date: Sun, 15 Oct 2006 14:09:15 +0200

Hi Brian,

the document covers all known attacks and counter measures against
SCTP (base protocol) and extensions like ADD-IP. So it does not fit
well as an Security Section in 2960bis.

I think it is a good idea to have it as a separate document.

Best regards
Michael

---

From: "Brian F. G. Bidulock" <[email-masked]>
Date: Sun, 15 Oct 2006 08:10:58 -0600

Michael,

Funny you should mention ADD-IP.  That is another document the draft
mentions in several places without referencing.

Do we publish RFCs containing threats to drafts?

--brian

Michael Tuexen wrote:                           (Sun, 15 Oct 2006 14:09:15)

-- 
Brian F. G. Bidulock
[email-masked]
http://www.openss7.org/

---

From: Lars Eggert <[email-masked]>
Date: Wed, 25 Oct 2006 15:39:17 +0200

This document talks about the SCTP implementors' guide a lot and how
   it "makes changes" to SCTP to fix the threats described here. The
   guide is not a specification - I assume 2960bis will also include
   these fixes? If so, it should be referred to instead of (or at least
   in addition to) the guide.

   The sections labeled "Errata" aren't errata ("a list of corrected
   errors"), they often contain a further analysis of the attack vector.
   Suggest to pick a different heading.

   The sections labeled "Countermeasure" often don't describe
   countermeasures but instead only offer observations about the attack
   (4.3) or partial mitigation (6.3). Suggest to pick a different
   headings for those cases.

Section 2.3., paragraph 1:
 >    HEARTBEAT-ACK the random nonce MUST match the value sent in the

   s/MUST/must/ (is the only 2119 term in the document)

Section 2.3., paragraph 2:
 >    will prevent an attacker from generating false HEARTBEAT-ACK's  
with

   Nit: s/HEARTBEAT-ACK's/HEARTBEAT-ACKs/

Section 4.2., paragraph 2:
 >       local lan is concerned.

   Nit: s/local lan/LAN/

-- 
Lars Eggert                                     NEC Network Laboratories

---

From: Randall Stewart <[email-masked]>
Date: Thu, 26 Oct 2006 15:50:13 -0400

>   in addition to) the guide.

Yep.. it includes the summarized final changes of RFC4460...

>   Suggest to pick a different heading.

Any preference on what you would like the headings to be?

>   headings for those cases.

Same question ?

>   s/MUST/must/ (is the only 2119 term in the document)

yep... I will fix this :-)
>  >    will prevent an attacker from generating false HEARTBEAT-ACK's  with
> 
ack

> Section 4.2., paragraph 2:
ack

R

-- 
Randall Stewart
803-345-0369 <or> 815-342-5222(cell)