RE: IPsec and RDDP as a transport

> [email protected] said:
> >> If one shot STags would have been an acceptable solution,
> >> why wouldn't making one shot STags a "MUST implement"
> >> be adequate?
> >
> > Because that would allow long-lived STags without requiring
> > the countermeasures for the security exposures they create.
> >
> 
> An existing TCP or SCTP application is not required to
> use IPsec, even if it is present.

This continues to confuse "MUST implement" with "MUST use".
The usual IETF requirement is "MUST implement" so that an
administrator can decide whether the network environment
contains security threats that justify use of security
measures such as IPsec.  The administrator is free not to
use IPsec, but it is better to "have and not need" than to
"need and not have" - the requirement that there be
mandatory-to-implement security avoids the latter.

[... snip ...]

> If one-shot STags are available as a "MUST Implement"
> feature then there is *no* additional vulnerability
> created by use of RDDP. All exposed buffers are exposed
> by action of the ULP itself.

In which case there's no downside to making all STags one-shot,
because everything still works, right?  In practice, the answer
is "no" because the use of long-lived STags gets locked
into ULP applications at implementation time, so when a user
discovers that long-lived STags cause security issues in
her network, she has no way to deal with them, short of
ceasing to use the application.  Avoiding this is the
rationale behind mandatory-to-implement security requirements.

If there are sufficient advantages to using long-lived STags
to justify their inclusion in the specification, then RDDP
is obligated to provide the security countermeasures to the
risks caused by long-lived STags.  An implementation that
omits long-lived STags is free to omit the security measures
needed to deal with them.

Thanks,
--David
----------------------------------------------------
David L. Black, Senior Technologist
EMC Corporation, 176 South St., Hopkinton, MA  01748
+1 (508) 293-7953             FAX: +1 (508) 293-7786
[email protected]        Mobile: +1 (978) 394-7754
----------------------------------------------------