Status:

Held for Document Update

Type:

Technical

Reported By:

Stéphane Bortzmeyer

Date Reported:

2016-08-10

Held for Document Update by:

Mirja Kühlewind

Date Held for Document Update:

2016-09-12

Section 7 says:

[The entire section]

It should say:

No suggested text because it requires a much more serious analysis. 
May be adding that the rate-limit counter SHOULD be per-connection, 
in the spirit of RFC 6528?

Notes:

It appears the section does not specify that the counter for ACK throttling SHOULD be per-connection. In Linux, it is apparently global, which allowed its use as a side channel enabling nasty attacks (CVE-2016-5696 and the paper "Off-Path TCP Exploits: Global Rate Limit Considered Dangerous" <http://www.cs.ucr.edu/~zhiyunq/pub/sec16_TCP_pure_offpath.pdf>).
Also see discussion on tcpm list about this reported errata!