Re: [ANCP] Privacy issue in draft-ietf-ancp-mc-extensions-12

Tom Taylor <tom.taylor.stds@gmail.com> Mon, 02 December 2013 09:59 UTC

Return-Path: <tom.taylor.stds@gmail.com>
X-Original-To: ancp@ietfa.amsl.com
Delivered-To: ancp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 61BAB1AE09E for <ancp@ietfa.amsl.com>; Mon, 2 Dec 2013 01:59:59 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zcEHAKA0Vndm for <ancp@ietfa.amsl.com>; Mon, 2 Dec 2013 01:59:57 -0800 (PST)
Received: from mail-ie0-x229.google.com (mail-ie0-x229.google.com [IPv6:2607:f8b0:4001:c03::229]) by ietfa.amsl.com (Postfix) with ESMTP id BBA4F1A1F3F for <ancp@ietf.org>; Mon, 2 Dec 2013 01:59:57 -0800 (PST)
Received: by mail-ie0-f169.google.com with SMTP id e14so20911200iej.28 for <ancp@ietf.org>; Mon, 02 Dec 2013 01:59:55 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; bh=K6cVUITrGyFE0ituV8rz0TTnLLq0B3fOQynQ4daISlg=; b=ZgDbRespm5ykQfD361nsABcdIpHBEtGN2P3s6oHojvg2EIV9k9C1uNe92l3OQ4ApXr rgnkaUl29zP1rly8f+Wc8VyVNCqqAOncfhkH0kmgbhWFrWR4pITjYMPlPp55GfAVoM6l RfcuXqNTgJXe/lSYdvkYsDTQ2mWVRDp/vxqdr+r2QN1R7FTecFdxJQGt1WkiWNWjY2E5 hB7e/wkx3AhFf0csjNVBWZvpvfLIFKi720dorLebPzsn3tgNFZjdcIA5U63lHxPgxE+z sI27v0vBSWN0QYmOrYk+lseFoTEjjQ32PslCxOOR/xgyUoeecB/Gkhl4Ys7sGCPsH0Fe mzLA==
X-Received: by 10.50.134.99 with SMTP id pj3mr16858194igb.14.1385978395369; Mon, 02 Dec 2013 01:59:55 -0800 (PST)
Received: from [192.168.1.65] ([64.56.250.4]) by mx.google.com with ESMTPSA id i11sm65246781igh.0.2013.12.02.01.59.54 for <multiple recipients> (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Mon, 02 Dec 2013 01:59:54 -0800 (PST)
Message-ID: <529C5A19.7080204@gmail.com>
Date: Mon, 02 Dec 2013 04:59:53 -0500
From: Tom Taylor <tom.taylor.stds@gmail.com>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.1.1
MIME-Version: 1.0
To: "Francois Le Faucheur (flefauch)" <flefauch@cisco.com>
References: <529BA104.2050500@gmail.com> <6EE0FD67-10BB-480C-941A-2C7986A91314@cisco.com>
In-Reply-To: <6EE0FD67-10BB-480C-941A-2C7986A91314@cisco.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Cc: "ancp@ietf.org" <ancp@ietf.org>
Subject: Re: [ANCP] Privacy issue in draft-ietf-ancp-mc-extensions-12
X-BeenThere: ancp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Access Node Control Protocol working group mailing list <ancp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ancp>, <mailto:ancp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/ancp/>
List-Post: <mailto:ancp@ietf.org>
List-Help: <mailto:ancp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ancp>, <mailto:ancp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 02 Dec 2013 09:59:59 -0000

This justification makes sense. I can think of use cases where one would 
want per-device control.

Tom

On 02/12/2013 4:11 AM, Francois Le Faucheur (flefauch) wrote:
> Hello Tom,
>
> I think these TLVs bring some value:
> The ANCP Multicast Admission Control message supports the "Conditional Access and Admission Control Use Case". When conditional access is to be performed on a per device basis (as opposed to per DSL line basis), the message needs to provide the NAS with a way to identify the device.
>
> In general (and more or less by definition) the NAS has a lot of visibility on each DSL line (certainly for unicast), so I assume the privacy concern is not so much about communicating the info to the NAS but has more to do with the risk of a monitoring attack of the ANCP protocol. Right?
>
> How about an alternative approach where we keep these TLVs in the document and keep them as optional, but add a note that says that:
> 	* including those TLVs in the message is only useful when the NAS is to perform per-device "Conditional Access and Admission Control"
> 	* including those TLVs in the message results in an increased privacy concern because it exposes on the wire the corresponding privacy information about which IP/MAC is accessing which multicast channel, which could be exploited by a monitoring attack on the ANCP protocol.
> 	* these TLVs SHOULD NOT be included when per-device "Conditional Access and Admission Control" by the NAS is not used
>
> Makes sense?
>
> Francois
>
> On 1 Dec 2013, at 21:50, Tom Taylor <tom.taylor.stds@gmail.com>
>   wrote:
>
>> In his review of draft-ietf-ancp-mc-extensions-12, our AD pointed out that the optional presence of the Request-Source-IP or Request-Source-MAC TLV in the ANCP Multicast Admission Control message posed privacy issues. Looking through the ANCP requirements in RFC 5851 and TR-101, I could find no requirement that these be reported.
>>
>> I proposed that these TLVs be dropped from the message and from the document. I will assume that I have consent for this change if I do not hear arguments against it by the end of Wednesday, December 18.
>>
>> Tom Taylor
>> _______________________________________________
>> ANCP mailing list
>> ANCP@ietf.org
>> https://www.ietf.org/mailman/listinfo/ancp
>
>