[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: TOS copying considered harmful
On Wed, 13 Sep 2000 ji@research.att.com wrote:
> > First, copying TOS is a security leak...
>
> Not more so than keeping the same packet size (rounded up to a multiple
> of 8)... ANyone running a tunnel paranoid enough to
> be worried about potential TA based on the TOS field will also know enough
> to pad packets and blot out the TOS field.
There is provision in ESP for adding extra padding to disguise packet
size, should an implementation wish to do so. There is no equivalent
authorization to obscure the TOS -- any such "blotting out" is currently a
violation of the IPsec specifications, and it is conceivable that odd
implementations could somehow rely on it not being done. I can understand
not making it mandatory (although IPsec already has too many optional
behaviors), but it should at least be permitted.
Henry Spencer
henry@spsystems.net
References: