Re: Call for Community Feedback: Guidance on Reporting Protocol Vulnerabilities

Toerless Eckert <tte@cs.fau.de> Tue, 27 October 2020 13:09 UTC

Return-Path: <eckert@i4.informatik.uni-erlangen.de>
X-Original-To: ietf@ietfa.amsl.com
Delivered-To: ietf@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 34F2A3A091B for <ietf@ietfa.amsl.com>; Tue, 27 Oct 2020 06:09:12 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.649
X-Spam-Level:
X-Spam-Status: No, score=-1.649 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HEADER_FROM_DIFFERENT_DOMAINS=0.25, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HBzJbi80r0Ax for <ietf@ietfa.amsl.com>; Tue, 27 Oct 2020 06:09:09 -0700 (PDT)
Received: from faui40.informatik.uni-erlangen.de (faui40.informatik.uni-erlangen.de [131.188.34.40]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7C6C53A08E7 for <ietf@ietf.org>; Tue, 27 Oct 2020 06:09:09 -0700 (PDT)
Received: from faui48f.informatik.uni-erlangen.de (faui48f.informatik.uni-erlangen.de [IPv6:2001:638:a000:4134::ffff:52]) by faui40.informatik.uni-erlangen.de (Postfix) with ESMTP id 102AA54843F; Tue, 27 Oct 2020 14:09:04 +0100 (CET)
Received: by faui48f.informatik.uni-erlangen.de (Postfix, from userid 10463) id 08E3D440059; Tue, 27 Oct 2020 14:09:04 +0100 (CET)
Date: Tue, 27 Oct 2020 14:09:04 +0100
From: Toerless Eckert <tte@cs.fau.de>
To: Roman Danyliw <rdd@cert.org>
Cc: "Salz, Rich" <rsalz=40akamai.com@dmarc.ietf.org>, "ietf@ietf.org" <ietf@ietf.org>
Subject: Re: Call for Community Feedback: Guidance on Reporting Protocol Vulnerabilities
Message-ID: <20201027130903.GA11207@faui48f.informatik.uni-erlangen.de>
References: <5081794697df44d8bd76b675cf08dc23@cert.org> <EB7E8597-087A-4E84-A90E-DC8DF7F089EB@akamai.com> <20201026193707.GC59330@faui48f.informatik.uni-erlangen.de> <fb5d37904b3d4cf5877a715192971f6b@cert.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <fb5d37904b3d4cf5877a715192971f6b@cert.org>
User-Agent: Mutt/1.10.1 (2018-07-13)
Archived-At: <https://mailarchive.ietf.org/arch/msg/ietf/9Ywfbvh9Y6-mL9V3GWqp_m8t31U>
X-BeenThere: ietf@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IETF-Discussion <ietf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ietf>, <mailto:ietf-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ietf/>
List-Post: <mailto:ietf@ietf.org>
List-Help: <mailto:ietf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ietf>, <mailto:ietf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 27 Oct 2020 13:09:12 -0000

Roman:

What you describe in the text is already suficiently convoluted (yepp, that's
what we are, you can't significanlty simplify it ;-)) that anyone not already
actively engaged in the IETF for longer would certainly be confused enough to
have question about process, how to follow up from reporting, looking for
help and so on. Hence the proposal to not only set up a list like
vulnerability-report@ietf.org, but also an open discussion mailing lists
vulnerability-discuss@ietf.org so that there is at least an easy, open point to discuss.

Or let me put it differently: I would not like for IETF to pick up on
a process like vulnerability reporting if it ends up being solely behind
closed doors without having a list for the community and those we want to
attact to discuss it. As any non-WG mailing list, discussion doesn't mean
to give any responsibility to produce IETF output to such a list.

Of course your text should go to the web page. I was merely pointing out
that anything beyond the established process we have today might want to
be starting less informal, as i think we wouldn't know by now what an ideal
process would be.

Finally: don't worry about taking the word "vulnerability" away from possible
later WGs. Its always been FCFS on names.

Cheers
    toerless


On Tue, Oct 27, 2020 at 11:56:35AM +0000, Roman Danyliw wrote:
> Hi Toerless!
> 
> Thanks for the review.  Inline ...
> 
> > -----Original Message-----
> > From: Toerless Eckert <tte@cs.fau.de>
> > Sent: Monday, October 26, 2020 3:37 PM
> > To: Salz, Rich <rsalz=40akamai.com@dmarc.ietf.org>
> > Cc: Roman Danyliw <rdd@cert.org>rg>; ietf@ietf.org
> > Subject: Re: Call for Community Feedback: Guidance on Reporting Protocol
> > Vulnerabilities
> >
> > Thanks, Roman
> >
> > Great job on describing the "process". Unfortunately, i think our process sucks,
> > e.g. errata will only be applicable in a small subset of cases.
> >
> > In general, it will not be possible to find community consensus to resolve
> > vulnerabilities, and even if there is consensus, doing document updates takes
> > even longer. Especially because in most cases you want to see good evidence
> > that the attack vector is likely to be used
> >
> > (just had a discussion today on dnsop, where the first reaction to a  protocol
> > implementation hardening suggestion i wanted to make in a draft  was rejected
> > with "we have not seen this attack vector being a problem so far").
> >
> > So, maybe we can while we have time step back a bit and think about what we
> > could do to incrementally improve our processes:
> 
> I want to separate the above into discrete problems in the vulnerability coordination process -- there is the reporting (how and to who to convey the information), validation/triage (how to ensure the accuracy of the information) and remediation (what does one do about it).  No question that the processes by which the community finds consensus on the remediation is challenging.  As might be convincing a recipient on the validating of the vulnerability to begin with.  However, neither of these is the scope of the proposal which is intended to be a much less ambitious scope -- how to _report_ the vulnerability to the IETF.
> 
> > I would suggest creating two mailing lists:
> >
> >   vulnerability-discuss@ietf.org or vulnerability-dispatch@ietf.org
> >   vulnerability-report@ietf.org
> 
> Point taken about the different between issues with operational practices and protocol vulnerabilities.
> 
> The thinking behind the last-resort alias name (protocol-vulnerability@ietf) was to provide sufficient distance from future WG names (*-dispatch@ietf), the LLC disclosure alias (operational-vulnerability@ietf.org), and any sense of it looking like it was triaging implementation issues.
> 
> > I think we don't need "protocol" in the names, because there are also
> > vulnerabilities to operational practices from OPS. Or probably vulnerabilities in
> > data models (hmm... are there ? -).
> >
> > The first list of course should serve as an easy entry point for anyone worried
> > about a particular vulnerability or the process and wants to get answers. And
> > hopefully it can be dispatched to the right WG  or more specific mailing list.
> > And then of course discuss about the process because with something as new
> > to the IETF as this we probably want to experiment with the process.
> >
> > The second list of course is what you called protocol-vulnerability@ietf.org
> 
> As I noted in my response to Eliot, the IETF could definitely go this way and have a centralized reporting, triage and dispatch process.  However, this would require a deliberate, consensus process.  The proposal here is a text for the website to explain what we do now.
> 
> > Ultimately, i think we will have the classical issue that more process on this
> > front would likely benefit from some intermediate output format between
> > draft/RFC and errata, i think Warren once called this "living documents". And i
> > think we should just experiment with that starting with Wiki or the like.
> 
> There is no reason why we couldn't put this text on a wiki, however it might be less impactful there.  The thinking was to make the text prominent on the main website.
> 
> Regards,
> Roman
> 
> 
> > Cheers
> >     Toerless
> >
> >
> > On Fri, Oct 23, 2020 at 07:58:29PM +0000, Salz, Rich wrote:
> > > I would put the "WE don't pay" sentence at the top, right after the intro
> > paragraph.
> > >
> > > ???On 10/23/20, 2:46 PM, "Roman Danyliw" <rdd@cert.org> wrote:
> > >
> > >     Hi!
> > >
> > >     The Internet Engineering Steering Group (IESG) is seeking community input
> > on reporting protocol vulnerabilities to the IETF.  Specifically, the IESG is
> > proposing guidance to be added to the website at [1] to raise awareness on
> > how the IETF handles this information in the standards process.  The full text
> > (which would be converted to a web page) is at:
> > >
> > >
> > > https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_medi
> > > a_documents_Guidance-5Fon-5FReporting-5FVulnerabilities-5Fto-5Fthe-5FI
> > > ETF-
> > 5FsqEX1Ly.pdf&d=DwIFAg&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx8
> > 6F
> > > tsKI-
> > w&m=ZJ9CHNaxYta4Rwzv9CsBCZ7S64SWbQDTXAsV8KWP_AU&s=WZ8lhkI2-
> > LqfcEW
> > > 09br2ItDhqh8U456y_8xZlTzatI0&e=
> > >
> > >     This text is intended to be written in an accessible style to help
> > vulnerability researchers, who may not be familiar with the IETF, navigate
> > existing processes to disclose and remediate these vulnerabilities.  With the
> > exception of creating a last resort reporting email alias (protocol-
> > vulnerability@ietf.org), this text is describing current practices in the IETF,
> > albeit ones that may not be consistently applied.
> > >
> > >     This guidance will serve as a complement to the recently written IETF LLC
> > infrastructure and protocol vulnerability disclosure statement [2].
> > >
> > >     The IESG appreciates any input from the community on the proposed text
> > and will consider all input received by November 7, 2020.
> > >
> > >     Regards,
> > >     Roman
> > >     (for the IESG)
> > >
> > >     [1] This guidance text would be added to a new URL at
> > > https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_stan
> > >
> > dards_rfcs_vulnerabilities&d=DwIFAg&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0
> > GbR
> > > 0h9Fvx86FtsKI-
> > w&m=ZJ9CHNaxYta4Rwzv9CsBCZ7S64SWbQDTXAsV8KWP_AU&s=lWrYlX
> > > 1pV0mIGIcyUbXXN4Bl4YdeeGExr508slPDgW8&e= , and then referenced from
> > > https://urldefense.proofpoint.com/v2/url?u=http-3A__www.ietf.org_conta
> > > ct&d=DwIFAg&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-
> > w&m=ZJ9CHN
> > >
> > axYta4Rwzv9CsBCZ7S64SWbQDTXAsV8KWP_AU&s=dVVEqnGAgxYTWKmevWh
> > 2AwAdymUCMQ
> > > Gs85MMBB2FYPs&e= ,
> > > https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_stan
> > >
> > dards_process_&d=DwIFAg&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx
> > 86FtsK
> > > I-w&m=ZJ9CHNaxYta4Rwzv9CsBCZ7S64SWbQDTXAsV8KWP_AU&s=A2QnAr-
> > kezfIPFF3J9
> > > 2rsAfyrfHzpdFR2gquELSO_5w&e= ,
> > > https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_stan
> > >
> > dards_rfcs_&d=DwIFAg&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86F
> > tsKI-w
> > >
> > &m=ZJ9CHNaxYta4Rwzv9CsBCZ7S64SWbQDTXAsV8KWP_AU&s=KtvC1SVlfZTcF
> > hsHQ9RvF
> > > _nm856pcSrouxEKNahI5UQ&e= , and
> > > https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_topi
> > >
> > cs_security_&d=DwIFAg&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86
> > FtsKI-
> > >
> > w&m=ZJ9CHNaxYta4Rwzv9CsBCZ7S64SWbQDTXAsV8KWP_AU&s=EN9keXxRYE
> > MvBt-h9ugF
> > > VkY3-MUUAv-X9mP7OpOa_po&e=
> > >
> > >     [2]
> > > https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_abou
> > > t_administration_policies-2Dprocedures_vulnerability-2Ddisclosure&d=Dw
> > > IFAg&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-
> > w&m=ZJ9CHNaxYta4R
> > >
> > wzv9CsBCZ7S64SWbQDTXAsV8KWP_AU&s=VAKeetf0jcEomZCLvqzNjCqSADPvs
> > RZPugO5C
> > > UryXDI&e=
> > >
> > >

-- 
---
tte@cs.fau.de