Re: [dispatch] DISPATCH IETF 111 meeting

Richard Barnes <rlb@ipv.sx> wrote:

> I hate sending symmetric keys around as much as the next person.  But we should be pragmatic here.

I think the NOT RECOMMENDED suggestion on the table is quite pragmatic. The suggestions here are much softer than the RFC 8996: "MUST NOT negotiate TLS 1.1".

> Here, SDES still does what it says on the label

I don't think that is true. SDES is labeled as an IETF proposed standard. It might barely have met the requirements for that when it was published, but it certainly does not anymore. While SDES is as insecure as it always has been, the distance between SDES and what is considered acceptable security has grown big.

-John

From: Richard Barnes <rlb@ipv.sx>
Date: Wednesday, 28 July 2021 at 19:26
To: John Mattsson <john.mattsson@ericsson.com>
Cc: dispatch@ietf.org <dispatch@ietf.org>
Subject: Re: [dispatch] DISPATCH IETF 111 meeting - preliminary outcomes and draft minutes
I hate sending symmetric keys around as much as the next person.  But we should be pragmatic here.

The situation with SDES is unlike the situation with a bunch of the other deprecations we have done recently (SSLv3, TLS 1.0).  There, the protocol was broken, in the sense that it does not provide the guarantees that it is supposed to provide.  Here, SDES still does what it says on the label, just like it always has; we’re just increasingly grumpy about that model and there are somewhat better alternatives.

Note “somewhat” — DTLS-SRTP is only better than SDES to the extent that the certificates in the DTLS exchange are verified independent of the signaling path.  If you rely only on the fingerprint in SDP for authentication, then an SDP-path entity can swap out fingerprints to intercept get keys just as well as with SDES.  (At best, this swaps an active for a passive attack, which is not nothing, but not a huge step.)  We do have mechanisms for such verification, but they’re not widely deployed.

All of which tells me that there's not an urgent need for action here.  SDES is not a looming threat to the Internet.  In the many deployments where it is used, it still does what it claims to do, and people have accommodated that into their broader system models.  Even if there were to be a mass migration to DTLS-SRTP, the actual security benefit for all that work would be fairly minor until we do a lot more work to solve the authentication problems.

So if folks want to make a bigger, scarier warning label to put on SDES to guide people away from it, sure, fine.  But it doesn’t seem like a blaring red warning light is called for.  In terms of this document, the content is probably mostly OK if we reframe it in that light.  Obsoleting SDES and marking it Historic, though, is over the top; it will just create unnecessary consternation.

--Richard

On Tue, Jul 27, 2021 at 7:08 PM John Mattsson <john.mattsson=40ericsson.com@dmarc.ietf.org<mailto:40ericsson.com@dmarc.ietf.org>> wrote:
westhawk thp@westhawk.co.uk<mailto:thp@westhawk.co.uk> wrote:

>> On 26 Jul 2021, at 23:30, Kirsty P <Kirsty.p=40ncsc.gov.uk@dmarc.ietf.org><mailto:&lt;Kirsty.p=40ncsc.gov.uk@dmarc.ietf.org&gt;> >wrote:

>>

>> SDP Security Descriptions is NOT RECOMMENDED and Historic: consensus was >sub-optimal. There was support for revisiting the space currently standardised >by SDP, but not on direction (whether to do a deprecation with/without >replacement). Future paths suggested included: mmusic, a new WG, more work >required for it to be ready, or a BoF (said in chat) to vet the idea further.

>My sense is that there was a rough consensus around a goal to make it possible >to deprecate SDES - but the required steps were unclear.

Yes, looking at the Jabber log there was quite strong support for the goal of deprecating SDES:

Eric Rescorla: Let's all just agree that this (Mattson's SDES) draft is a good idea and promote it to full standard toda
Martin Thomson: now that I see John presenting this, I have to wonder: why didn't this deprecation happen before?
Sean Turner: When Dan Wing got up and said not to use SDES in Berlin - I assumed that was that ;)
Pete Resnick: Why "NOT RECOMMENDED" instead of "MUST NOT"?
Sean Turner: +1 to what ekr said
Rich Salz: +1 also

Regarding the next required steps I agree with Pete. Let’s charter.

Ben Kaduk: So is this dispatch to BoF, or straight to WG?
Pete Resnick: @ben: Sounds like this discussion has done the equivalent of BoFing. Charter.

Cheers,
John
_______________________________________________
dispatch mailing list
dispatch@ietf.org<mailto:dispatch@ietf.org>
https://www.ietf.org/mailman/listinfo/dispatch