Re: [Model-t] Small sub-team for drafting - volunteers?

[Eric Rescorla <[e-mail]>]

On Tue, Sep 29, 2020 at 2:24 PM Jari Arkko <[e-mail]> wrote:

> I’m sitting here and scratching my head about possible ways to go about
> this effort. Let me propose a straw man and see if people agree.
>
> First, off, re-stating goal of the exercise: work through example(s) to
> show a chain from (1) specific security threats to (2) general guidance
> that can be derived from them to (3) how such guidance would potentially be
> useful for protocol designs. In a way that they could take it into account
> and design something better. Non goals include going through more than a
> single or a couple examples, or attempting to boil the entire space. Just
> an example so that we can show some of the work  can be useful.
>
> Everyone with me so far? If not, I should say that it is late here and
> that you should let me know what  the exercise was :-)
>

Not really. I don't understand what the objective is. To recap, the purpose
of this section of RFC 3552; Section 3 is to document the threat model that
people should be using to evaluate their protocols. The examples in that
document are intended to illuminate that threat model.



> But going on to examples. One might think for instance that you could
> derive example fairly simple examples of the chain. E.g.
> - specific threat: messaging systems where the system sees private
> messaging between people, which may lead to e.g., a government attempts to
> get them to hand over the messaging, commercial surveillance, or accidental
> leaks
> - general guidance: apply end-to-end security, avoid involving third
> parties except for their specific role (e.g., message forwarding)
> - specific technologies that can be designed to improve past designs: MLS
>

> Or:
> - specific threat: mobile authentication systems being vulnerable to
> attacks against SIM card manufacturers or the transfer of SIM card keys to
> operators
> - general guidance: limit the scope of compromise, and assume compromise
> may happen anywhere. See draft-arkko-farrell-model-t-3552-additions Section
> 5.1 (by Ekr and Chris). Or forcing active attack (S5.2)
> - specific technologies: apply perfect forward secrecy in relevant
> protocols.
>
> Or:
> - specific threat: tracking of users in web browsing, for various purposes
> including advertising, and using various methods
> - general guidance: <various>
> - specific technologies: <various>
>

These seem like they might be reasonable recommendations, but they don't
seem to have much to do with the purpose of documenting the threat model.

-Ekr


> And so on.
>
> Are these the kinds of things that people had in mind? Or something else?
>
> Jari
>
> --
> Model-t mailing list
> [e-mail]
> https://www.iab.org/mailman/listinfo/model-t
>