The Architecture of Direct Data Placement (DDP) and Remote Direct Memory Access (RDMA) on Internet Protocols
draft-ietf-rddp-arch-07

I"m not convinced the security considerations is adequate.

I see several threat issues.  The first is the tension between direct copy and packet authentication.  In many cases, it is not possible to authenticate a packet until the entire thing has been read.  But here, the data is being copied to a receiving buffer directly from the wire, before authentication takes place.  This is especially a challenge to a multi-threaded interface --- ATM where the cells for some packet are not consecutive, perhaps -- where you might get interleaving.

More generally, authorization for access to storage has to be dependent on the connection as well as the steering tag.  Otherwise, you introduce new vulnerabilities.  This is especially problematic given that receive buffers may (according to the document) be used for data from a different socket.

Aside: I think that many of these issues, as well as the multiple receiver problem (and I do not accept the argument that requiring many different clients to use the same address is in any way comparable to any existing problem in that space), would go away if the steering tag sent over the wire to the receiver were not just opaque, but by intent a random 64- or 128-bit tag to a local buffer descriptor.  That permits easy local revocation of capabilities, as well as a defense against remote contamination attempts if the value were communicated previously over an encrypted channel.