Subject: Re: [ippm] IESG review of draft-ietf-ippm-owdp-reqs-04.txt

From: stanislav shalunov <[email-masked]>
Date: 28 Feb 2003 08:15:27 -0500

http://www.internet2.edu/~shalunov/ippm/draft-ietf-ippm-owdp-reqs-05.txt
has been submitted to the internet-drafts repository.

Its purpose is to address replay attack issues raised in Steve
Bellovin's security review.

To save you the trouble of digging it out and running diff, the
following substantially new text was included:

6.6. Replay Attacks

   OWAMP-Control must be resistant to any replay attacks.

   OWAMP-Test, on the other hand, is a protocol for network measurement.
   One of the attributes of networks is packet duplication.  OWAMP-Test
   has to be suitable for measurement of duplication.  This would make
   it vulnerable to attacks that involve replaying a recent packet.  For
   the recipient of such a packet it is impossible to determine whether
   the duplication is malicious or naturally occurring.

   OWAMP-Test should measure all duplication -- malicious or otherwise.
   Note that this is similar to delay attacks: an attacker can hold up a
   packet for some short period of time and then release it to continue
   on its way to the recipient.  There's no way such delay can be
   reliably distinguished from naturally occuring delay by the
   recipient.

   OWAMP-Test should measure the network as it was.  Note, however, that
   this does not prevent the data from being sanitized at a later stage
   of processing, analysis, or consumption.  Some sanity checks (those
   that are deemed reliable and erring on the side of inclusion) should
   be performed by OWAMP-Test recipient immediately.
_______________________________________________
ippm mailing list
[email-masked]
http://mailhost.advanced.org/mailman/listinfo/ippm