Re: Comments on ldup-sync-02

That's finem, though it seems like this is stating the obviuous -- though
we have all been known to miss the obvious on occasion ;-(

John  McMeeking



                                                                                                                          
                      "Kurt D.                                                                                            
                      Zeilenga"                To:       John McMeeking/Rochester/IBM@IBMUS                               
                      <[email protected]        cc:       [email protected]                                                
                      g>                       Subject:  Re: Comments on ldup-sync-02                                     
                                                                                                                          
                      06/06/2003 04:57                                                                                    
                      PM                                                                                                  
                                                                                                                          
                                                                                                                          




At 01:56 PM 6/6/2003, John McMeeking wrote:
>A few comments on draft-zeilenga-ldup-sync-2.txt:

Thanks.  I largely concur with your comments and hence
limit my comments to the one issue I think needs further
discussion.

>2.1.2 syncCookie (also Security Considerations).  Does the mention of a
>digital signature belong here?  I don't see that tampering with a cookie
>would be any worse than tampering with anything else in the protocol.  I
>don't see how a malformed cookie could give you access to data you aren't
>authorized to.  At worst, it could cause the client to miss changes or get
>redundant changes. Any result returned should be subject to the server's
>access control mechanisms.

I think the short of it is that servers have to be prepared to deal
with cookies which have been tampered with.  Depending on the
information held in the cookie, it may be difficult for server
implementors to ensure that all possible cookie values are safe.
And, as we know, implementors don't always think of every possible
attack.  So, use of a digital signature to detect tampering may
be reasonable protective measure.  An easy way to include a
digital signature is to include some secret information in the
hash suggested in 2.1.2.

I suggest it only be mentioned in Security Considerations section.
  Implementors should take precautions against malicious cookie
  content, including malformed cookies or valid cookies used with
  different security associations and/or protections in attempt to
  obtain unauthorized access to information.  Servers may include a
  digital signature in the cookie to detect tampering.
as there is no need to imply that this would be done generally.

Would this be reasonable?