Subject: Re: TTL=255 on xmit, no check on receipt please

From: Stuart Cheshire <[email-masked]>
Date: Mon, 9 Dec 2002 16:07:42 -0800

>>First, TTL and security.  I thought we had come to the consensus
>>that checking the TTL had no particular security value.
>
>No. The comment made was that we wouldn't discuss security, and
>whether the TTL value has security merit. There was no consensus that
>I saw to actually conclude whether there were any security advantages.

Yes,

Dan is correct. My point was that there is some security benefit to 
knowing that the packet originated locally, but trying to quantify that 
benefit is a religious argument that will never be settled by discussion 
in this Working Group.

The simple argument why there is a non-zero security benefit (without 
trying to quantify exactly how large the benefit is) is by analogy to 
firewalls:

Assertion: Link-local provides a security benefit strictly stronger than 
the benefit provided by a corporate firewall:

1. A corporate firewall limits the population of potential attacker hosts 
to devices that are attached to any one of the set of logical (link-layer 
or "layer 2") links that are deemed 'inside' the firewall.

2. At a large company, there may be many logical links in this set.

3. Checking TTL=255 on link-local packets limits the population of 
potential attacker hosts to just one link.

4. Therefore, if a corporate firewall limits the population of potential 
attacker hosts, then checking TTL=255 on link-local packets limits the 
attacker population at least as much, and usually more.

Therefore, if there is some benefit to limiting the population of 
potential attacker hosts (and clearly the majority of the world thinks 
there is), then there is benefit to enforcing that link-local packets 
actually originated on the local link.

Ignoring for a moment the question of what deployed systems do today, 
let's consider ideal behaviour:

1. Link-local packets are intended for use only on the local link,
   (we have DHCP servers, routers, etc., for off-link communication)
2. There is no mechanism (and no intention of creating a mechanism)
   for using link-local addresses to communicate with hosts
   not directly attached to a common link
   (that would be duplicating existing functionality)
3. Therefore: any link-local packet arriving from outside the local
   link can have no legitimate valid purpose, and should be discarded.

Stuart Cheshire <[email-masked]>
 * Wizard Without Portfolio, Apple Computer, Inc.
 * Chairman, IETF Zeroconf
 * www.stuartcheshire.org

---

From: Keith Moore <[email-masked]>
Date: Mon, 09 Dec 2002 20:06:54 -0500

> benefit is a religious argument that will never be settled by discussion 

actually it seems that you would rather not discuss security benefits
than to have the weaknesses of such arguments exposed.

> trying to quantify exactly how large the benefit is) is by analogy to 

the principal security benefit in firewalls is that they make it easier
to analyze the network for threats by reducing the number of potential
threats that need to be considered.  to repeat - firewalls don't necessarily 
reduce the actual number of threats to any significant degree - they only 
makes the analysis easier.  this is a good thing, but it shouldn't be oversold.

there are several reasons this benefit doesn't automagically extend to LL 

- one is that LL is less compatible than firewalls with many apps

- another is that it's one thing for a site to analyze its security risks
  in the presence of firewalls, given knowledge of its own network, the
  apps that it runs, the assets it must protect, and so on.  It's quite 
  another thing for a code or hardware vendor to make assumptions about
  the customer's environment and the degree to which threats are reduced
  by use of LL.

- a third is that while LL may prevent some off-link traffic from getting
  to a host, it may also provide new paths by which unauthorized traffic 
  can reach a host

- fourth, the additional measures that apps need to use to function in
  the presence of LL may themselves introduce security holes.

>    link can have no legitimate valid purpose, and should be discarded.

Why is this ideal behavior?  What does it have to do with the group's goals
as stated in its charter?

Keith

---

From: Thomas Narten <[email-masked]>
Date: Tue, 17 Dec 2002 13:52:40 -0500

> benefit is a religious argument that will never be settled by discussion 

But saying that because we can't quantify it or can't get agreement
means we need to drop discussion of the topic misses the point.

One has to weigh the potential benefits (including security, if any)
when deciding whether the benefits of a TTL=255 check are high enough
to out weight the negatives (like reduced interoperability).

Thomas

---

From: "John C. Welch" <[email-masked]>
Date: Tue, 17 Dec 2002 14:09:01 -0500

> to out weight the negatives (like reduced interoperability).

While there are very few true security benefits, the ability to easily
discard routed LL packets is an operational benefit that should be
implemented. The interoperability issues with non 255 packets can be fixed
via update mechanisms easily enough.

john

-- 
John C. Welch
Consultant III
Administrative Computing
(617) 253 - 1368 work
(508) 579 - 7380 cell
bynkii2          AIM