Re: [arch-d] [Model-t] Possible new IAB program on Internet trust model evolution

[Christian Huitema <[e-mail]>]

On 1/24/2020 12:35 PM, Ted Hardie wrote:

>     As far as the second point goes, I think that when you are
>     thinking about comsec protocols it's still true that you can't do
>     much if you don't trust the endpoints. I think 3552 could be a bit
>     better about recognizing that there are malicious actors in the
>     system, though obviously that's implicit in the discussion of DoS.
>     Anyway, this doesn't seem like much of an update to the threat model.
>
>
> Here, I think the point is really to move the IETF away from thinking
> in terms of host requirements. I agree with you that there are pieces
> to this that are very similar whether you think of  JS code in a
> sandboxed tab or about an IoT device or about TOPS-20 device connected
> to an IMP.  But if you assume that the PC running the browser hosting
> that tab is the unit of analysis, you might have a very bad time. 
> Again, not really a change in the threat model, but a change in the
> context.  This may be a way of saying that I agree with your point below.


Phrasing that as "don't trust the endpoints" is probably inappropriate.
My personal worry is the cascading impact of end-point compromise. Take
the example of a large network. Large network means multiple routers. If
the multiple is high enough, we have strong risks that one of those will
be compromised at some point. If we merely "trust the endpoints", then a
single compromise of one of the endpoints means the game is over. But it
does not have to be so. In an ideal world, implementations of the
routing protocol should be able to detect aberrant behavior and isolate
the compromised node. In practice, that's really hard. But there are
still general principles like "least amount of privilege" or "need to
know basis" that could help. I would really like that protocol designers
think about that too, instead of merely asserting trust in the endpoints.

And I would really like to get rid of the assumption about isolated
networks being secure...

-- Christian Huitema