Subject: Re: suggestion needed....

From: Vernon Schryver <[email-masked]>
Date: Wed, 26 Dec 2001 14:27:35 -0700 (MST)

> >    may i know if there are any specific RFCs for the implementation of 
> > the INITIAL SEQUENCE NUMBER.
>
> RFC 1948.  It remains very important to implement ISN right,
> because sequence number guessing attacks are still a serious risk.
>   http://www.cert.org/advisories/CA-2001-09.html

Yes, but it's also worthwhile to be skeptical of the ISN testers and
certifiers.  I've seen hysterical (in both senses) alarms about
supposedly terrible ISN schemes that, while they failed tests on high
speed LANS, did not have holes that would much less difficult to
exploit from outside than RFC 1948 schemes.

There are not many bits in the sequence number to randomize as
suggested by RFC 1948 or anything else, what with the birthday
paradox and the need to stay away from the sequence numbers of
recent connections.  On the other hand, ISN schemes are rarely
among the biggest holes on LANs inside firewalls.

Then there is the fact that the worst that can be done with an ISN
attack is to create an illicit TCP connection.  Unless you are foolish
enough to authenticate and authorize services based on IP addresses,
that is not much of a worry.

Such wet-blanket considerations don't concern some security vendors
and professional security chicken littles.

Vernon Schryver    [email-masked]