Re: [Add] Private IPs, DDR, and PR#11

[Michael Richardson <[e-mail]>]

Eric Rescorla <[e-mail]> wrote:
    > I've been spending some time thinking about PR#11 and trying
    > to figure out the threat model where it brings value. This
    > message is an attempt to get to a better understanding. As
    > should be clear, I'm a little confused, so if people want
    > to tell me why I'm wrong, that would be helpful.


    > First, let's start with what I take to be the network topology:

I think that the implicit placing of the CPE IP + the ISP Resolver on the
same subnet suggests more security than is really the case.
I can forgive the numbering and imagine that the ISP Resolver is really on
some other subnet, some distance away.  But, therein lies the issue.

The ISP Network hop could involve a significant stretch across a Metro network.
(in most Canadian provinces, the DSL connection travels across province to
some DC, often on a wide variety of third party fibers, which are trivially
subject to Mallory-in-the-Rough [offpath] eavesdropping)
This use case is even part of the APN (BOF) use case situation.

    > ISP Resolver
    > 192.0.2.1
    > |
    > | <- ISP Network
    > |
    > 192.0.2.100
    > CPE/DNS Proxy
    > 10.0.0.1
    > |
    > | <- Home network
    > |
    > 10.0.0.100
    > Users device

    > 2. Either the home network or the ISP network is insecure, otherwise
    > you don't need DoX.

So the word "insecure" is ambiguous here.
It could mean:
Malory-in-The-Middle, Malory-on-the-side, malory-in-the-rough

DoX defends against many of these things.

We agreed in add that we have to assume that the home network's DHCP is
secure (via DHCP/RA-Guard filters on the home router's wifi hairpin).
I'm unclear if we have real ARP-spoofing guards.

    > OPPORTUNISTIC MODE
    > So, first, its not entirely clear to me what the Opportunistic mode of
    > S 4.2 provides. In this scenario, presumably the client will be doing
    > TLS to the CPE (because otherwise the IP address would be the
    > resolver's public address), which means that we are concerned with the
    > attacker controlling the home network. So, in this scenario, we are
    > only getting value if you have a network in which:

    > 1. The attacker can *see* traffic not destined for their IP address
    > (otherwise there's not much point in encrypting).

ARP-spoofing of ".1" is common and in some cases, even considered a feature
that enables a VPN.

    > 2. The attacker cannot forge traffic from another IP address
    > (otherwise they can just impersonate the CPE because there
    > is no certificate).

DHCP Guard makes this harder.

    > Are there an appreciable number of networks with these properties? If
    > so, can we write down where that happens and put it in Security
    > Considerations? If not, we should consider removing this mode.

I mostly agree.

    > So, first, what threat model are we concerned with:

    > 1. If it's control of the home network, then why can't the attacker
    > block the _SVCB record between the user and the CPE stopping
    > them from upgrading?

Because that depends upon the kind of attack you are assuming.

--
Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide