A new Request for Comments is now available in online RFC libraries.
RFC 5961
Title: Improving TCP's Robustness to Blind
In-Window Attacks
Author: A. Ramaiah, R. Stewart,
M. Dalal
Status: Standards Track
Stream: IETF
Date: August 2010
Mailbox: [email protected],
[email protected],
[email protected]
Pages: 19
Characters: 44717
Updates/Obsoletes/SeeAlso: None
I-D Tag: draft-ietf-tcpm-tcpsecure-13.txt
URL: http://www.rfc-editor.org/rfc/rfc5961.txt
TCP has historically been considered to be protected against spoofed
off-path packet injection attacks by relying on the fact that it is
difficult to guess the 4-tuple (the source and destination IP
addresses and the source and destination ports) in combination with
the 32-bit sequence number(s). A combination of increasing window
sizes and applications using longer-term connections (e.g., H-323 or
Border Gateway Protocol (BGP) [RFC4271]) have left modern TCP
implementations more vulnerable to these types of spoofed packet
injection attacks.
Many of these long-term TCP applications tend to have predictable IP
addresses and ports that makes it far easier for the 4-tuple (4-tuple
is the same as the socket pair mentioned in RFC 793) to be guessed.
Having guessed the 4-tuple correctly, an attacker can inject a TCP
segment with the RST bit set, the SYN bit set or data into a TCP
connection by systematically guessing the sequence number of the
spoofed segment to be in the current receive window. This can cause
the connection to abort or cause data corruption. This document
specifies small modifications to the way TCP handles inbound segments
that can reduce the chances of a successful attack. [STANDARDS TRACK]
This document is a product of the TCP Maintenance and Minor Extensions Working
Group of the IETF.
This is now a Proposed Standard Protocol.
STANDARDS TRACK: This document specifies an Internet standards track
protocol for the Internet community,and requests discussion and suggestions
for improvements. Please refer to the current edition of the Internet
Official Protocol Standards (STD 1) for the standardization state and
status of this protocol. Distribution of this memo is unlimited.
This announcement is sent to the IETF-Announce and rfc-dist lists.
To subscribe or unsubscribe, see
http://www.ietf.org/mailman/listinfo/ietf-announce
http://mailman.rfc-editor.org/mailman/listinfo/rfc-dist
For searching the RFC series, see http://www.rfc-editor.org/rfcsearch.html.
For downloading RFCs, see http://www.rfc-editor.org/rfc.html.
Requests for special distribution should be addressed to either the
author of the RFC in question, or to [email protected]. Unless
specifically noted otherwise on the RFC itself, all RFCs are for
unlimited distribution.
The RFC Editor Team
Association Management Solutions, LLC
_______________________________________________
IETF-Announce mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/ietf-announce
