1 / 5

Security Assessment of the Internet Protocol version 4 (draft-gont-opsec-ip-security)

Security Assessment of the Internet Protocol version 4 (draft-gont-opsec-ip-security). Fernando Gont on behalf of UK CPNI 73 rd IETF meeting, November 16-21, 2008 Minneapolis, MN, USA. Problem statement.

nowles
Download Presentation

Security Assessment of the Internet Protocol version 4 (draft-gont-opsec-ip-security)

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Security Assessment of the Internet Protocol version 4(draft-gont-opsec-ip-security) Fernando Gont on behalf of UK CPNI 73rd IETF meeting, November 16-21, 2008 Minneapolis, MN, USA

  2. Problem statement • There is no single document that discusses the security implications of the IPv4 protocol and the possile mitigation approaches • As a result, • It becomes really hard to produce a resilent IPv4 implementation from the RFCs • New implementations of IPv4 re-implement bugs/vulnerabilities that had already been found in older stacks • Sometimes new protocols re-implement mechanism that had already been found to have negative security implications

  3. Document overview (I) • In 2005, UK CPNI started a project to change this state of affairs • The goal of the project was to perform a security assessment of the relevant specifications, discuss counter-measures where necessary, and also research what real implementations were doing. • Some of the areas that were explored as part of this project: • Enforcing checks on each of the header fields • Security implications of each of the header fields • Security implications of each of the IPv4 mechanisms (e.g., fragment reassembly) • The result was a 60-page document, with 95+ references to relevant specifications, papers, etc.

  4. Document overview (II) • draft-gont-opsec-ipsecurity is CPNI’s effort to take the results of tat project to the IETF. • Document revision history: • -00: initial version, posted on August 2008. • -01: Simply fixes boiler-plate issues. • While the current version is -01, it has already been thoroughly reviewed by a number of people, and has resulted in a 70-page document.

  5. Moving forward Should this document be adopted as a wg item?

More Related