bk99.de entertain the web since 1997

bk99.de
RFC · SecurityStandard explained

RFC 5961: Hardening TCP against blind reset and SYN attacks

Summary

RFC 5961 improves TCP checks so that spoofed segments find it harder to reset or disrupt existing connections. Small state checks can greatly increase the cost of an attack. Old protocols stay robust through targeted, compatible fixes.

Ideas

  • Challenge ACKs check suspicious reset segments.
  • Stricter sequence number checks reduce blind hits.
  • SYN handling within existing connections is hardened.

Remarks

  • RFC 5961 has the status “Proposed Standard”; current errata and successor documents should also be checked.

Recommendations

  • Keep the kernel and network stack up to date.
  • Monitor unusual reset and challenge ACK rates.

References

Read the RFC at the RFC Editor

Search the Web Archive

RFC · 2014

RFC 7258: Pervasive monitoring is an attack

RFC 7258 explicitly declares large-scale passive monitoring a form of attack that protocol design must take into account. Threat models have to include powerful global observers. Encryption by default changes privacy for the whole network.

RFC · 2004

RFC 3711: SRTP: Confidential real-time media

RFC 3711 adds encryption, integrity and replay protection for audio and video streams to RTP. Real-time security must combine low delay with effective protection. Key management remains a central task outside the media format.