Subject: Re: Security discussion for TTL=255 now out of scope

From: Stuart Cheshire <[email-masked]>
Date: Fri, 29 Nov 2002 11:35:12 -0800

>- all senders should set the TTL to 1. This ensures that routers won't
>  forward them off link.

Unnecessary.

Not sending LL packets to the router in the first place ensures that the 
router won't forward them off link.

>- setting the TTL to anything other than 1 (and especially 255) seems
>  nuts, as it makes it much more likely that LL packets will leak to
>  places where they don't belong. And what would be the benefit of
>  using a higher TTL? 
>
>- the only reason I can think of to set the TTL to 255 on send is if
>  you want the receiver to check for that value. But why would anyone
>  care to do that? (remember, I (and others) can't site security
>  arguments...)

That's not what I said.

I said that that we should halt the endless debate about whether the 
security benefit is small or large.

If you want to make the qualitative (not quantitative) argument that 
there is ZERO security benefit to knowing that the packet originated 
on-link, then I suppose we can start that debate, but it would seem that 
every company, organization, and individual around the world who has 
installed a firewall has spoken with their dollars and disagrees with 
that position.

Stuart Cheshire <[email-masked]>
 * Wizard Without Portfolio, Apple Computer, Inc.
 * Chairman, IETF Zeroconf
 * www.stuartcheshire.org

---

From: Keith Moore <[email-masked]>
Date: Fri, 29 Nov 2002 14:55:59 -0500

> security benefit is small or large.

this supposed benefit is being used to justify a dubious design decision.
what you seem to be trying to do is stifle debate about the merits of
that design decision.

---

From: "John C. Welch" <[email-masked]>
Date: Fri, 29 Nov 2002 16:52:04 -0500

> what you seem to be trying to do is stifle debate about the merits of

There is *no* security in watching a TTL value. Let me say that again:

There is NO security in the TTL value

The TTL value in no way shape or form protects your network/nodes/data, it
doesn't prevent  other people from getting to that.

It has only one purpose WRT to LL...to make sure that LL packets do not get
out of the local link. That's it. If you want to make TTL a security
feature, then I recommend another WG start up that looks at ways of
verifying that the TTL is correct, if there isn't one already.

To drag security into what is purely an operational/administrative decision
serves no purpose other than dragging this process out still further.

john

-- 
John C. Welch
Consultant III
Administrative Computing
(617) 253 - 1368 work
(508) 579 - 7380 cell
bynkii2          AIM