Re: [i2rs] Kathleen Moriarty's Discuss on draft-ietf-i2rs-protocol-security-requirements-07: (with DISCUSS and COMMENT)

[Spencer Dawkins at IETF <[e-mail]>]

Dear All,

On Thu, Aug 18, 2016 at 3:02 PM, Andy Bierman <[e-mail]> wrote:

>
>
> On Thu, Aug 18, 2016 at 12:44 PM, Susan Hares <[e-mail]> wrote:
>
>> Andy:
>>
>>
>>
>> Thank you – I thought it was on whether we could implement insecure
>> transport in a Yang module.
>>
>>
>>
>> The requirement text you are working with is:
>>
>>
>>
>>    SEC-REQ-08: The I2RS protocol MUST be able to transfer data over a
>>    secure transport and optionally MAY be able to transfer data over a
>>    non-secure transport.
>>
>>
>>
>> I do not understand why approving the ok for non-secure transport for
>> some modules means the following to you:
>>
>>
>>
>> *“ the IETF needs to agree that there could never possibly be any
>> deployment that would not want to allow exposure of the data.*
>>
>> *Not now. Not 20 years from now.”*
>>
>>
>>
>
>
> As I understand it, this requirement has another requirement associated
> with it
> that says the data has to be identified as OK-for-nonsecure-transport.
>
> An extension in the data model says that all instances of the object in
> all possible deployments cannot be considered sensistive and therefore
> needs disclosure protection.
>
> It may seem like even a simple octet counter is safe to send in the clear,
> but not if that opens up correlation attacks.  (e.g., I can send data to
> some
> host.  I can see that index 455992 is incrementing the in-octets counters
> in a way that strongly correlates to my test traffic.  Therefore I can
> learn
> that arbitrary index 455992 is really John Doe or really suite #14, etc.
>

Since Kathleen asked what other ADs were thinking ...

I'm current on this thread, as of the time I'm sending my note, but
replying to Andy's note because it's poking where I am poking.

So, if (say) an octet counter is considered safe to send in the clear, and
a Yang model that reflects that is approved and widely deployed, and then
someone realizes that it's not safe to send in the clear, is that a big
deal to fix, and get the updated Yang model widely deployed?

My opinion on this point has a lot to do with how hard it is to recover if
a Yang model gets this wrong ...

My apologies for not understanding enough about Yang and I2RS to be able to
answer my own question, of course.

Thanks,

Spencer