Re: [bfcpbis] Spencer Dawkins' Discuss on draft-ietf-bfcpbis-rfc4582bis-15: (with DISCUSS and COMMENT)

Hi, Alissa,

On Nov 6, 2015 7:06 AM, "Alissa Cooper" <alissa@cooperw.in> wrote:
>
> Hi Spencer,
>
>
>
> On Nov 5, 2015, at 11:20 PM, Spencer Dawkins at IETF <
spencerdawkins.ietf@gmail.com> wrote:
>
>> Hi, Charles,
>>
>> On Thu, Nov 5, 2015 at 5:43 PM, Charles Eckel (eckelcu) <
eckelcu@cisco.com> wrote:
>>>
>>> For TCP, the use of TLS was not required by RFC 4582. For 4582bis, we
do not require TLS in order to maintain backward compatibility with RFC
4582.
>>
>>
>> Got it. I'm holding my nose on this one, based on backward
compatibility, and given the degree of difficulty in splicing attack
packets into the TCP sequence numbering space if you're off-path. I'm not
thrilled, but someone else needs to decide when threats reach the level
where making that incompatible change is necessary - and that might not be
the right thing to do today.
>>
>>>
>>> For UDP, the reason for not mandating DTLS is backward compatibility
with existing solutions. The IMTC Role Based Video Best Practice
established a set of recommendations for getting BFCP to work  within
enterprise video conference deployments. As that
time,draft-sandbakken-xcon-bfcp-udp defined BFCP over UDP only. DTLS was
left for future study. Today we have many implementations of BFCP over UDP,
but few if any using DTLS. We need the ultimate RFC that standardizes BFCP
over UDP (and over DTLS) to allow interworking with these existing
deployments.
>>
>>
>> OK, I'm not the Protocol Security Police, so, fine, but it seems like
the draft could be clearer about this, and what you said in your answer
would be really helpful in the document.
>>
>> If the text said something like "DTLS is REQUIRED unless you are
interworking with a pre-standardization deployment that is already insecure,
>
>
> "REQUIRED unless" strikes me as a faulty construction. That case is what
RECOMMENDED is for, when there is a known exception to the requirement.

That usage is certainly more common in some parts of the IETF than others,
but it does get used. But ignoring that.

Do you think "RECOMMENDED unless you are interworking with a
pre-standardization deployment that is already insecure" is tight enough?

The reason I'm asking, is that offpath attacks on UDP-based protocols are a
lot easier than TCP-based protocols, and if the IETF is going to publish a
proposed standard with a known deficiency to accommodate
pre-standardization deployments, I'd prefer that the guidance about using
that accommodation be as clear as possible.

Thanks,

Spencer

> Alissa
>
>> in which case you're not making things worse by running without
transport-level security", that would capture my concern and reflect what
you're saying, unless I'm missing something.
>>
>> Thanks to you and Paul for the speedy response on the evening of Bits
and Bites!
>>
>> Spencer
>>
>> _______________________________________________
>>
>> bfcpbis mailing list
>> bfcpbis@ietf.org
>> https://www.ietf.org/mailman/listinfo/bfcpbis