[Atoca] Remarks on the security discussion today

[Hannes Tschofenig <[e-mail]>]

Hi all, 

in the discussions today a few interesting remarks were raised. I wanted to share them with you. Richard, Martin and Cullen listed two aspects that need to be described in the requirements/architecture document, namely 

(1) How does the recipient/receiver learn which author/originator to trust?

In this case Richard distinguished two scenarios:

a) Tsunami warning

Here the warning may be provided to the recipient/receiver by some local entity. How does the author/originator know when it receives an alert that can indeed be trusted? It could be sent by anyone. It is not very likely that the author of the message is known.

For this specific case Richard suggested to build on the work in draft-rosen-ecrit-lost-early-warning-01.txt. The basic idea is that the receiver uses LoST to discovers organizations issuing alerts for specific geographical regions. When an alert is received then the author and/or originator fields are checked against the info previously obtained via LoST. 

b) School closed warning

Here, the recipient will have a prior relationship with the author (the school). A prior "registration" step is likely going to be required. 

(2) Transitive Trust vs. End-to-End Security

In order to ensure that the comparison between the identity information can be processed by the recipient/receiver there is a need for cryptographic assurance. During the meeting we had discussed the possibility to use transitive trust (I know my service provider and I assume that he will only accept and forward alerts it got from other trusted sources) and end-to-end security. 

In the area of end-to-end security it was noticed that the deployment reality of SIP (and XMPP) with regard to e2e security is rather weak. Security at the alert level was seen as OK but XMLDSIG was not acceptable. 

I hope my writeup makes sense (even though I am tired already). 

Ciao
Hannes