Re: STag value choices

At 10:51 PM 2/20/2004, [email protected] wrote:
>The concern is not about an STag being bit-errored into another STag,
>but rather that if an adversary knows the algorithm being used to generate
>STag values (e.g., can predict the next one that an implementation
>will generate), certain aspects of forging and injecting traffic 
>become easier (e.g., more of the forged traffic can be precomputed).

Remember too that the scope of the STag is important to
consider. Generally speaking, STags are constrained to be
valid only in the context of a single connection. In this case
the adversarial peer has not gained access to any additional
memory than that which was already granted.

The Architecture document specifically states that ddp_register()
permits access to the registered buffer via the resulting STag
on the specific "socket" (endpoint, queuepair) where the
registration was performed. This is not intended to exclude the
possibility of wider scope, but warns (in the security section)
that widening the scope has security implications.

Tom.