Subject: [tsvwg] I-D Action:draft-ietf-tsvwg-port-randomization-06.txt

From: [email-masked]
Date: Mon, 15 Feb 2010 15:30:01 -0800 (PST)

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Transport Area Working Group Working Group of the IETF.

	Title           : Transport Protocol Port Randomization Recommendations
	Author(s)       : M. Larsen, F. Gont
	Filename        : draft-ietf-tsvwg-port-randomization-06.txt
	Pages           : 33
	Date            : 2010-02-15

Recently, awareness has been raised about a number of "blind" attacks
that can be performed against the Transmission Control Protocol (TCP)
and similar protocols.  The consequences of these attacks range from
throughput-reduction to broken connections or data corruption.  These
attacks rely on the attacker's ability to guess or know the five-
tuple (Protocol, Source Address, Destination Address, Source Port,
Destination Port) that identifies the transport protocol instance to
be attacked.  This document describes a number of simple and
efficient methods for the selection of the client port number, such
that the possibility of an attacker guessing the exact value is
reduced.  While this is not a replacement for cryptographic methods
for protecting the transport-protocol instance, the described port
number obfuscation algorithms provide improved security/obfuscation
with very little effort and without any key management overhead.  The
algorithms described in this document are local policies that may be
incrementally deployed, and that do not violate the specifications of
any of the transport protocols that may benefit from them, such as
TCP, UDP, UDP-lite, SCTP, DCCP, and RTP (provided the RTP application
explicitly signals the RTP and RTCP port numbers).

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-tsvwg-port-randomization-06.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.