Re: [Last-Call] Last Call: <draft-gont-numeric-ids-sec-considerations-06.txt> (Security Considerations for Transient Numeric Identifiers Employed in Network Protocols) to Best Current Practice

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Everything else Christian says here about QUIC is accurate.  I see nothing there that suggests a problem in need of attention.  I would also point to https://tools.ietf.org/html/draft-ietf-quic-load-balancers for a more nuanced treatment of the connection ID selection problem.

On Thu, Dec 17, 2020, at 16:19, Christian Huitema wrote:
> An informational document documenting a series 
> of past attacks would be interesting and educational. The kind of rule 
> making proposed in the draft, on the other hand, would be mostly harmful.

...but this is the most important message.  Removing Section 5 and all that depends on it would make this a better document.

Separately, I found the list of potential problems in Section 4 to be approximately OK, though it lacked any mention of a need to synchronize changes across protocol layers.  I acknowledge that that is about use rather than generation, but that is quite relevant here too.

-- 
last-call mailing list
last-call@xxxxxxxx
https://www.ietf.org/mailman/listinfo/last-call



[Index of Archives]     [IETF Annoucements]     [IETF]     [IP Storage]     [Yosemite News]     [Linux SCTP]     [Linux Newbies]     [Mhonarc]     [Fedora Users]

  Powered by Linux