Subject: [Softwires] Port set algorithm for LW4o6

From: Tom Taylor <[email-masked]>
Date: Mon, 18 Feb 2013 11:40:28 -0500

Would it be possible to specify the same port set algorithm in LW4o6 as 
in MAP-E? This would simplify the description of the unified CPE. The 
effect on security of using a deterministic algorithm for the complete 
set (but not precluding random assignment within that set) would 
probably be minimal.

Tom Taylor

---

From: Ted Lemon <[email-masked]>
Date: Mon, 18 Feb 2013 19:57:10 +0000

On Feb 18, 2013, at 11:40 AM, Tom Taylor <[email-masked]> wrote:
> The effect on security of using a deterministic algorithm for the complete set (but not precluding random assignment within that set) would probably be minimal.

As close to zero as to not matter, I think.

---

From: <[email-masked]>
Date: Tue, 19 Feb 2013 15:06:09 +0100

Hi Tom,

You may be interested in reading this document: http://tools.ietf.org/html/draft-bsd-softwire-stateless-port-index-analysis-00,  in particular:

   In each analyzed port derivation algorithm, an attacker may implement
   a redirection loop to detect a significant amount of allowed ports.
   For all monotonously scattered schemes, the whole Port-Set may be
   deduced by extrapolation while this is not applicable for contiguous
   port ranges (because no information about port bounds is leaked in
   the IPv4-translatable IPv6 address).

Cheers,
Med 

>-----Message d'origine-----
>De : [email-masked] 
>[mailto:[email-masked]] De la part de Tom Taylor
>Envoyé : lundi 18 février 2013 17:40
>À : Softwires
>Objet : [Softwires] Port set algorithm for LW4o6
>
>_______________________________________________
>Softwires mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/softwires
>

---

From: Ted Lemon <[email-masked]>
Date: Tue, 19 Feb 2013 14:23:43 +0000

>   the IPv4-translatable IPv6 address).

This seems like massive overkill.   The attacker can just ask someone who's connected to the network what port set algorithm is in use.   Then, given one known port, all other ports for that host are known.   Keeping the local port set allocation algorithm secret would be impossible for an ISP, and pretty difficult even for an enterprise, since some machine at the enterprise is probably 0wned by a botnet.

---

From: Qi Sun <[email-masked]>
Date: Tue, 19 Feb 2013 23:25:43 +0800

Dear Med,

Embedding IPv4 address and port set in IPv6 address is a kind of port set algorithm as well. The attacker can also deduce the port set once the embedding algorithm is learned. IMHO, this may not increase security comparing to other port set allocation algorithms. Now that the effect on security would be minimal (at lease in my opinion), more attention can be paid to the simplicity and less modification to the current Internet elements. 

Please correct me if my understanding is wrong :)

Best Regards,
Qi Sun