Subject: [IPsec] Textual changes to the DDoS draft

From: Yoav Nir <[email-masked]>
Date: Mon, 22 Feb 2016 13:20:49 +0200

Hi all

Valery submitted a new PR with a couple of textual changes, mostly based on comments by Dave.

https://github.com/ietf-ipsecme/drafts/pull/12 <https://github.com/ietf-ipsecme/drafts/pull/12>

The changes (listed below) seem fine to me. If nobody objects, I will merge them in on Friday.

Yoav

List of changes:

#1: Change snarky reference to Starbucks to something less snarky and less related to starbucks:
OLD:
For example, if a certain purveyor of beverages resembling coffee provides Internet connectivity to its customers through an IPv4 NAT device, a single malicious customer can create enough half-open SAs to fill the quota for the NAT device external IP address. Legitimate Initiators on the same network will not be able to initiate IKE.

NEW:
For example, if an network service provider or some establishment offers Internet connectivity to its customers or employees through an IPv4 NAT device, a single malicious customer can create enough half-open SAs to fill the quota for the NAT device external IP address. Legitimate Initiators on the same network will not be able to initiate IKE.

#2: Purely textual change
OLD:
Regardless of the type of rate-limiting used, there is a huge advantage in blocking the DoS attack using rate-limiting in that legitimate clients who are away from the attacking nodes should not be adversely affected by either the attack or by the measures used to counteract it.

NEW:
Regardless of the type of rate-limiting used, there is a huge advantage in blocking the DoS attack using rate-limiting for legitimate clients that are away from the attacking nodes. In such cases, adverse impacts caused by the attack or by the measures used to counteract the attack can be avoided.

---

From: "Waltermire, David A." <[email-masked]>
Date: Fri, 26 Feb 2016 00:03:22 +0000

I haven't seen any additional feedback on the DDoS draft this week based on Yoav's note about the PR [1]. It also looks like the discussion on chaining puzzles has wrapped up with no changes needed to the draft [2].

Unless there is any additional concerns with these issues, I believe we are ready for a WGLC on an updated revision of the draft.

Once Yoav posts the updated draft based on the PR, I'll issue the WGLC.

Thanks for working through these last issues.

Thanks,
Dave

[1] https://mailarchive.ietf.org/arch/msg/ipsec/XjuWvb9PvVjH1YMSzAMkAuC1zOQ
[2] https://mailarchive.ietf.org/arch/msg/ipsec/yeS8ooGWfvnxfs8zS24LYYpr9QM

From: IPsec [mailto:[email-masked]] On Behalf Of Yoav Nir
Sent: Monday, February 22, 2016 6:21 AM
To: [email-masked] WG <[email-masked]>
Subject: [IPsec] Textual changes to the DDoS draft

Hi all

https://github.com/ietf-ipsecme/drafts/pull/12

Yoav

List of changes:

NEW:

NEW:

---

From: Yoav Nir <[email-masked]>
Date: Fri, 26 Feb 2016 07:43:34 +0200

> On 26 Feb 2016, at 2:03 AM, Waltermire, David A. <[email-masked]> wrote:
> 
> I haven’t seen any additional feedback on the DDoS draft this week based on Yoav’s note about the PR [1]. It also looks like the discussion on chaining puzzles has wrapped up with no changes needed to the draft [2].

Oh. My impression of [2] was that Valery and I were in agreement that this change was a good idea, with Scott and Yaron supporting (not quite as enthusiastically) and with not opinions to the contrary. Valery and I thought we’d make this change over the weekend.

Yoav

---

From: "Valery Smyslov" <[email-masked]>
Date: Fri, 26 Feb 2016 08:50:08 +0300

That was also my impression. And the draft is already being edited to include multiple puzzles.

Valery.
  ----- Original Message ----- 
  From: Yoav Nir 
  To: Waltermire, David A. 
  Cc: [email-masked] WG 
  Sent: Friday, February 26, 2016 8:43 AM
  Subject: Re: [IPsec] Textual changes to the DDoS draft

  Yoav

------------------------------------------------------------------------------

  _______________________________________________
  IPsec mailing list
  [email-masked]
  https://www.ietf.org/mailman/listinfo/ipsec

---

From: Yaron Sheffer <[email-masked]>
Date: Fri, 26 Feb 2016 08:32:36 -0800

After reading the pull request, I suggest that we require the responder 
to verify all 4 puzzles. Although I don't have a proof why this is 
better (e.g. a game theoretic cost/benefit analysis), it would remove an 
unnecessary design decision from implementations at a trivial cost in 
performance.

Thanks,
     Yaron

On 02/25/2016 09:50 PM, Valery Smyslov wrote:
>     *From:* Yoav Nir <mailto:[email-masked]>
>     *To:* Waltermire, David A. <mailto:[email-masked]>
>     *Cc:* [email-masked] WG <mailto:[email-masked]%20WG>
>     *Sent:* Friday, February 26, 2016 8:43 AM
>     *Subject:* Re: [IPsec] Textual changes to the DDoS draft
>
>
>>     On 26 Feb 2016, at 2:03 AM, Waltermire, David A.
>>     <[email-masked] <mailto:[email-masked]>> wrote:
>>
>>     I haven’t seen any additional feedback on the DDoS draft this
>>     week based on Yoav’s note about the PR [1]. It also looks like
>>     the discussion on chaining puzzles has wrapped up with no changes
>>     needed to the draft [2].
>
>     Oh. My impression of [2] was that Valery and I were in agreement
>     that this change was a good idea, with Scott and Yaron supporting
>     (not quite as enthusiastically) and with not opinions to the
>     contrary. Valery and I thought we’d make this change over the
>     weekend.
>
>     Yoav
>
>     ------------------------------------------------------------------------

---

From: "Valery Smyslov" <[email-masked]>
Date: Tue, 1 Mar 2016 09:07:55 +0300

Hi Yaron,

I also think that it's more safe to verify all 4 results (that's why it's SHOULD). 
If nobody objects we can make it MUST for the sake of security and simplicity.

Regards,
Valery.

  ----- Original Message ----- 
  From: Yaron Sheffer 
  To: Valery Smyslov ; Yoav Nir ; Waltermire, David A. 
  Cc: [email-masked] 
  Sent: Friday, February 26, 2016 7:32 PM
  Subject: Re: [IPsec] Textual changes to the DDoS draft

  After reading the pull request, I suggest that we require the responder to verify all 4 puzzles. Although I don't have a proof why this is better (e.g. a game theoretic cost/benefit analysis), it would remove an unnecessary design decision from implementations at a trivial cost in performance.

  Thanks,
      Yaron

    Valery.
      ----- Original Message ----- 
      From: Yoav Nir 
      To: Waltermire, David A. 
      Cc: [email-masked] WG 
      Sent: Friday, February 26, 2016 8:43 AM
      Subject: Re: [IPsec] Textual changes to the DDoS draft

      Yoav

--------------------------------------------------------------------------
      _______________________________________________
      IPsec mailing list
      [email-masked]
      https://www.ietf.org/mailman/listinfo/ipsec