Re: [RPSEC] Topic 1: Section 3.1 Threat Sources

Sandy,

> (2.a) That doesn't apply to some (many?) protocols.
>
> For some protocols, there is no sense of an authorized peer.  For
> OSPF (that is, before the MD5 part got added), OSPF speaks to all
> routers on the local link that answer to the AllSPFRouters multicast
> address.  MANET protocols frequently speak over the broadcast link
> (as mentioned earlier in the draft).  And so forth.

You are right. IMHO, however, this is because in most IGPs, authentication
(such as MD5) is used a mechanism of authorization, instead of
identication. And current implementations just don't care the
identification in most cases.

But in the future, we might also want to care about the identification as
well.

> (2.c) It's misleading, security wise.
>
> When I saw this in the draft, I got to thinking about what makes a
> threat source distinct.  A threat source should be considered
> separately if it has a capability that gives it extra power, if it can
> launch attacks that others cannot, or if there are security
> defenses that work against it and not against others.  Now an
> unauthorized router has the same capabilities and can perform the same
> attacks as a masquerader, but it can be eliminated by doing pure
> address based filtering of some sort where masqueraders cannot.
>
> By that criterion, the unauthorized router is a separate threat source
> only if one considers pure address based filtering as a "security
> defense".
>
> I don't.  In a big way, I don't.  To call such an easily circumvented
> mechanism a security defense makes me extremely uneasy.
>
> I was emboldened to speak up about this by reading the IAS security
> mechanisms draft draft-iab-secmech-02.txt that came out a few weeks
> ago.  Bellovin, Kaufman and Schiller list address-based authentication
> as an "Insecurity Mechanism", along with plaintext passwords (emphasis
> on the "In").  To quote, "Some common security mechanisms are part of
> the problem rather than part of the solution."
>
> I think if we left unauthorized routers as a distinct threat source,
> we'd see claims like ".. and our ACME router's address filtering
> eliminates unauthorized routers, recognized by the IETF as one of the
> biggest threats to routing.."

I agree w/ you using a pure address filtering mechanism is insecure. But I
don't think it is the only mechanism to seperate masqueraders from the
unauthorized. For example, digital signature can be used for
identification while MD5 can be used for authorization.

Yi

_______________________________________________
RPSEC mailing list
RPSEC@ietf.org
https://www1.ietf.org/mailman/listinfo/rpsec