Re: [Detnet] [RTG-DIR] Rtgdir last call review of draft-ietf-detnet-security-10

[Eric Gray <[e-mail]>]

Stewart,

	I am going to assume that you mean "DetNet" when you refer to "DN" (maybe I'm wrong?).

	I am not certain that your "active attacker" assumption is correct even in this limited case, but you were responding on the subject of "gender neutrality" and whether or not it is appropriate to use "MITM" (presumably in general).

	That topic is no longer in the realm of "DetNet specific."  So your response should probably not be written (or read) as if it were.

	In your own words, however, one reason for passive listening is "technical surveillance to intervene more effectively" - which would seem to apply to DetNet at least as much as to anything else.

	This is not necessarily a generic privacy concern, as a passive MITM could be waiting for some specific activity (or activities) to occur in what would clearly be a "special class" of communications (such as DetNet would be).

	As I implied in a separate discussion, a MITM active attacker is rather easy to detect and deal with - unless it targets a specific subset of users or applications in unpredictable ways.  If it remains passive, the only way to detect it is from information leakage that would otherwise be unexplainable.

	If a malicious actor has other ways to perpetrate an attack, a passive MITM could be used to select targets, or select timing, and otherwise remain undetected over a long period of time.

	Presumably, DetNet traffic is self-announced "important" traffic.  If this does not increase its vulnerability to active or passive MITM hazards, then it would be good to be assured of that.

--
Eric

--
Eric

-----Original Message-----
From: Stewart Bryant <[e-mail]> 
Sent: Thursday, August 6, 2020 1:13 PM
To: Eric Gray <[e-mail]>
Cc: Stewart Bryant <[e-mail]>; Adrian Farrel <[e-mail]>; [e-mail]; [e-mail]; [e-mail]
Subject: Re: [RTG-DIR] [Detnet] Rtgdir last call review of draft-ietf-detnet-security-10
Importance: High

We are talking about the threats in DN. 

I think we should be focusing on the things that are special to DN which is a technology that adds certain properties to a general network. I assume the protection of the general network using the normal techniques is a given.

Passively looking at the contents is about privacy and technical surveillance to intervene more effectively.

Privacy obviously applies to a general network, and I take it as read that we protect against this. However this document is about DN, and I cannot see what the privacy concerns are about the DN specifics.

- Stewart



> On 6 Aug 2020, at 14:05, Eric Gray <[e-mail]> wrote:
> 
> Stewart,
> 
> 	Actually, in addition to the many things that are strange about this entire conversation, your observation about the "thing in the middle" (I mean, let's face it, the "entity" in the middle - EITM? - has been gender-neutral for a long time, given that any human participation in the role could be detected by an idiot) being necessarily _active_ is not quite correct.
> 
> 	It seems to me to be quite reasonable that the middle position could as easily be used to passively collect information for use in other activities - including a few fairly well known attacks.
> 
> --
> Eric
> 
> -----Original Message-----
> From: rtg-dir <[e-mail]> On Behalf Of Stewart Bryant
> Sent: Thursday, August 6, 2020 8:52 AM
> To: Adrian Farrel <[e-mail]>
> Cc: [e-mail]; [e-mail]; 
> [e-mail]
> Subject: Re: [RTG-DIR] [Detnet] Rtgdir last call review of 
> draft-ietf-detnet-security-10
> 
> 
>> ---
>> 
>> It would be nice to avoid the term "man-in-the-middle" (and 
>> coresponding
>> "MITM") in favour of the term "on-path attacker". It is less 
>> problematic as a term, and no less accurate.
>> 
>> Although "man-in-the-middle" is well established, I think you could 
>> easily avoid it and if you feel necessary you could use "An on-path 
>> attacker (formerly known as a man-in-the-middle) ..."
> 
> I sort of understand why you want to change MITM, although given that the man you have in mind is evil I am not sure whether it is that objectionable in this context. However I am not sure on-path is the right term. MITM normally implies an entity that can modify traffic in flight, whereas an on path attacker may simply be an observer.
> 
> Maybe AITM (attacker ....) would be a better gender neutral term.
> 
> Stewart
> 
>