Re: [dhcwg] WGLC for draft-ietf-dhc-sedhcpv6-02 - Respond by May 18

[神明達哉 <[e-mail]>]

At Fri, 9 May 2014 18:44:57 -0400,
Ted Lemon <[e-mail]> wrote:

> > My main concern is the combination of authenticating clients with the
> > leap of faith model. [...]
>
> You are right--I don't think there is a use case for leap-of-faith with clients.

Okay.

> > I'm okay with separating such discussions outside of this document.
> > But then I'd personally like to see a "threat analysis" document
> > first (covering these points), not the other way around. [...]
>
> We are in the awkward situation that lots of DHCP people already know what the threat models are, although I think you are correct that they have not been clearly articulated in a threat analysis document.   I think such a document would be a good idea.   However, I'm reluctant to delay this document on that basis.   It might make sense to do so, but I will leave that up to the working group to debate.

I don't want to be a blocker for this document because of this,
either.  If the rest of the wg thinks this is sufficiently
substantial, that's fine; if not, but it's actually to be considered,
hopefully a security AD will raise a concern at the time the IESG
review; and if that's not even the case, presumably my point is not
really that important.  I'm okay with any of these possibilities.

With noting this, if I may make a specific suggestion for the draft:

- provide some specific common use cases of server authentication and
  client authentication
- provide considerations on the applicability of the leap of faith
  model for these cases.  in particular, note that there is no known
  use case for client authentication with leap of faith

These can go to the introduction or a small separate section.  And, I
believe these can be sufficiently concise to fit in the protocol
document without breaking its scope too much (and I think it's a
reasonable compromise if we don't want to delay this document for a
more formal threat analysis).

On top of these, I'd even say: client authentication with leap of
faith SHOULD NOT be used until a clear use case is identified.

And, for the security considerations section on the resource
exhaustion attacks I'd revise it so it will:

- note that as long as the above 'SHOULD NOT' is honored this should
  be less concerned because this "attack" is much less
  likely/realistic on clients.  (in other words, this is another
  reason why we should discourage the use of client authentication
  with leap of faith)

> > Considerations like the possibility of resource exhaustion attacks as
> > mentioned in Section 7 of the draft.
>
> Leap-of-faith typically involves some kind of act of faith before trusting a key.   E.g., with ssh, that's the user saying "yes, go ahead."   I don't think you could do a resource exhaustion attack in this situation.

True, but this type of "act of faith" is not very feasible for servers
since it requires human intervention (ssh itself is a proof of this).
In the case of DHCP servers, I'm actually still not sure if this is a
real threat (because they should already manage other types of
possibly stale client related resources), but if we still consider
this as a security matter, we need something else than the ssh kind of
"act of faith".  My suggestion above is one such thing.

--
JINMEI, Tatuya