Re: [Pearg] Brian Trammell's Yes on draft-irtf-pearg-numeric-ids-history-09: (with COMMENT)

["Iván Arce (Quarkslab)" <[e-mail]>]

Hello Brian

my comments below

On 6/16/22 11:13, Brian Trammell via Datatracker wrote:

> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
> 
> This document is ready for publication on the IRTF stream.
> 
> Two questions, though (my Yes here does not depend on the answers):
> 
> (1) I notice that most of the chronologies seem to shift from academic
> citations to I-Ds and don't shift back; did academia lose interest in these
> issues at that time, or did the literature search only cover the time before
> the discussion moved to various IETF working groups?

It is hard to tell if academia lost interest in those topics. The 
security practitioners certainly have kept looking for the same issues 
(and finding them) in new protocol implementations, for example in the 
stacks used by IoT devices.

On the academic side, I think there may be two trends at play:

1- Interest have moved up stack, to the session/app layer and therefore 
there isn't so much focus on

2- There is a marked tendency towards thinking that cryptography solves 
this type of issue. That is partially truth, indeed transport layer 
security that provide certain guarantees to numeric ID fields at the 
protocol level, address several of the issues we mention, but not all of 
them. Particularly cryptography isn't particularly good for solving MATE 
(Monkey-At-The-End) problems, in which a legitimate peer can take 
advantage of weak numeric ID generation algorithms to infer internal 
state from the counterpart or to attack other peers.

In any case, we believed that having these issues addressed at the IETF 
level would help to fix them, or at least reduce their occurrence, at 
the root level and thus wanted to properly reference those efforts.

> 
> (2) The document has a significant number of informative references to
> abandoned I-Ds. Were these submitted for adoption by the associated WGs (i.e.,
> it'd be interesting to know if the WG process failed to address mitigations for
> these identification issues), or merely intended as points of discussion?
> 

The first version of the I-D is from 2016 so you can imagine that along 
the timeline several of the referenced I-Ds evolved in different ways, I 
have not looked at the details but I think most of them were adopted as 
work items by the WGs and some of the issues we pointed out were 
incorporated in drafts that were then worked on. I believe Fernando may 
have a better view of how that process went.

Regards,
/ivan

-- 
Iván Arce
Chief Research Officer
Quarkslab