Re: [cicm] FW: comments on CICM

[Alfonso De Gregorio <[e-mail]>]

Hi all,

On Thu, Aug 4, 2011 at 2:36 PM, David A. McGrew
<[e-mail]> wrote:
> On the goal of improving the state of the art of IETF security protocol
> implementation, there are a lot of open questions, and it would be essential
> to investigate the details of how the CICM model could work with Internet
> protocols.  The CICM model (in which there is a secure side, and insecure
> side, and a crypto module between, and there are two messages queues that
> connect the module to each side, and don't pass any information back) is far
> from current practice for IETF security protocols.  I assume that the goal
> for using a queue as an interface is to prevent side channels that could
> pass information from one side to the other.   This could prevent a
> subliminal channel that could potentially be exploited by an untrustworthy
> application on the secure side to slowly leak information out to the
> insecure side, I suppose, which would be good in an implementation
> environment that already has strong separation between secure/insecure
> sides.   But how many implementations of IETF protocols support such strong
> separations?    This raises the question: what benefit does the CICM model
> provide in cases where there is no such separation?
>
> For improving current Internet practice, there are some other problem areas
> that in my opinion deserve to be addressed first, including reducing
> implementation flaws and the possibilty of remote timing attacks.  Perhaps a
> message queue could be used to defeat timing attacks (like those against
> exponentiation algorithms or typing patterns in text-oriented protocols),
> though I am not sure if that is an explicit goal.   But increased
> implementation complexity would likely increase the number of implementation
> flaws.   At any rate, defeating a timing attack doesn't require hiding
> return codes from a calling application.  Perhaps there is another class of
> attacks being addressed by that approach, though I'm not quite sure what it
> protects against.

David, I believe your post raises a number of relevant questions.
Investigating them can really help us in describing -- maybe a topic
for a new ID? -- how the CICM model could work with Internet
protocols.

While the CICM model can be beneficial in enforcing the star-property
(therefore, mitigating the information leak and contributing towards
the overall confidentiality), it can help us in providing also
stronger integrity guarantees.

Let's consider, for example, systems implementing strong isolation
between different security domains or even system-level components
(e.g., networking, or storage), so that their compromise don't affect
the integrity of the rest of the system. In the open-source world,
this is the case of Qubes, where security domains are lightweight
virtual machines (VM) and the networking code, including drivers and
protocol stacks, has been confined  (using IOMMU/VT-d) to an
unpriviledged VM, called the Network Domain.

The CICM model would fit well into this class of architectures, where:
- the "Network Domain" (or the communication channel) is the insecure side;
- the crypto module can be run in a separate domain (*), isolated from
the world-facing networking code that might be exploited, sooner or
later;
- security protocols (e.g, VPN protocols) are also implemented in
separate domains, exposing their services (e.g., virtual network
interfaces) to the other privileged domains.

(*) far from suggesting that isolation mechanisms based on IOMMU/VT-d
are sufficient per se in achieving high assurance.

Hence, from a security architecture perspective, CICM may have a
positive impact in both the confidentiality and integrity guarantees
provided by IETF protocol implementations.

Which protocols?

> It seems to me that the protocol that best matches the CICM model is IPsec,
> but there are still many open questions about how it could work, such as:
> how would this map onto the idea of an IPsec Security Association Database?
>   Where would the different parts of the IPsec architecture reside?   What
> would happen to information that needs to be copied from one side to the
> other, such as a ToS byte?   what happens to how ICMP gets handled in IPsec?

Agreed. IPsec looks to be the best match, as well all cryptographic
protocols supporting the establishment of VPN connections.

I'm thinking also about domain security services, such as those
described by RFC 3183 (Domain Security Services using S/MIME).


> I personally feel that work on improving the practice of security protocol
> implementations would be valuable, but that the best approach would be to
> identify the most significant threats and vulnerabilities, then work on
> mitigating them.   For instance, it would be worthwhile to develop an
> interface to cryptography that kept details about initialization vectors
> inside the crypto module, since it is widely regarded that IVs can be a
> problem area.  But if there is interest in applying the CICM model to
> Internet practice, I would suggest starting with the applicability questions
> that other people and I have raised (Paul Hoffman had some good suggestions
> in the BoF), and I would be willing to participate at least as a reviewer.
>
> Apologies for the somewhat rambling email.
>
> David

I'd be super happy to join the CICM activities, in the way the group
believes to be best.

alfonso


-- 
 tweets @secYOUre      blog. http://Plaintext.crypto.lo.gy/