Re: [Model-t] Considerations for modern COMSEC protocol design

[Jim Fenton <[e-mail]>]

On 2/17/20 12:47 PM, Stephen Farrell wrote:
> Hiya,
>
> Thanks for the great text. That really ought land in some
> I-D or RFC sometime. (I'd probably like to use that with
> permission in our I-D if that'd be ok.)
>
> While I agree with all your text, there's maybe a little
> more to say on this bit...
>
> On 17/02/2020 17:06, Eric Rescorla wrote:
>> FORCING ACTIVE ATTACK
>> RFC 3552; Section 3.2 notes that it is important to consider passive
>> attacks. In general, it is much harder to mount an active attack, both
>> in terms of the capabilities required and the chance of being
>> detected. Another theme in recent IETF protocols design is to build
>> systems which might have limited defense against active attackers but
>> are strong against passive attackers, thus forcing the attacker to go
>> active. Examples include DTLS-SRTP and the trend towards opportunistic
>> security. However, ideally protocols are built with strong defenses
>> against active attackers. One prominent example is QUIC, which takes
>> steps to ensure that off-path connection resets are intractable in
>> practice.
> I'm still a fan of opportunistic security (OS) as
> described in RFC7435, but in the time since that was
> written, I think I've slightly modified my position on
> the topic. Nowadays, I think OS is most useful when
> it's a practical step on a realistic path from OS to
> defense against active attackers, e.g. the evolution
> from where we were in 2014 to MTA-STS (RFC8461) is
> maybe a good example. I won't try wordsmith that in,
> but be interested if you/others think similarly.


I'm somewhat less of a fan of opportunistic security; before deciding
that the capabilities required for an active attack are harder to mount,
you need to consider the threat model. Consider that there are several
countries that have been launching downgrade attacks against SMTP
STARTTLS on a substantial fraction of their outgoing traffic [1]. And
that doesn't even consider more targeted attacks against specific clients.

[1] Durumeric, Zakir, David Adrian, Ariana Mirian, James Kasten, Elie
Bursztein, Nicolas Lidzborski, Kurt Thomas, Vijay Eranti, Michael
Bailey, and J. Alex Halderman. 2015. “Neither Snow Nor Rain Nor MITM...:
An Empirical Analysis of Email Delivery Security.” In /Proceedings of
the 2015 Internet Measurement Conference/, 27–39. IMC ’15. Tokyo, Japan:
Association for Computing Machinery.
https://doi.org/10.1145/2815675.2815695.