Re: [arch-d] [Model-t] Possible new IAB program on Internet trust model evolution

[Eliot Lear <[e-mail]>]

> On 25 Jan 2020, at 02:56, Christian Huitema <[e-mail]> wrote:
> 
> 
> Phrasing that as "don't trust the endpoints" is probably inappropriate.
> 

Why?  They are the source of just about all compromise attacks.
> My personal worry is the cascading impact of end-point compromise. Take the example of a large network. Large network means multiple routers. If the multiple is high enough, we have strong risks that one of those will be compromised at some point. If we merely "trust the endpoints", then a single compromise of one of the endpoints means the game is over. But it does not have to be so. In an ideal world, implementations of the routing protocol should be able to detect aberrant behavior and isolate the compromised node. In practice, that's really hard.
> 
We sell product that does this today.  But it is hard, which is why people pay us.  Of course, it gets harder with encryption, but we even have product for that.  I prefer the other approach: tell us what good behavior looks like (manufacturer usage descriptions).

> But there are still general principles like "least amount of privilege" or "need to know basis" that could help.
> 
Indeed.
> I would really like that protocol designers think about that too, instead of merely asserting trust in the endpoints.
> 

How much is this the protocol and how much is the application?  The protocols most apps are using today are, ermmm, HTTP.

Eliot