Re: [saag] can an on-path attacker drop traffic?

[Eric Rescorla <[e-mail]>]

On Sat, Oct 3, 2020 at 7:25 PM Michael Richardson <[e-mail]>
wrote:

>
> Eric Rescorla <[e-mail]> wrote:
>     > As I think this discussion reveals, we don't have a really precise
>     > description of MITM, in part because it's quite an old term from an
> era
>     > where we had much less ability to analyze security protocols than we
> do
>     > today. One result of improvements in analysis is the need for precise
>     > definitions so that we can formalize the guarantees of systems
> against
>     > those definitions.
>
> I'm very much in agreement.
>
>     > For capabilities, our basic assumption is what is often called a
>     > Dolev-Yao attacker, in which the attacker has complete control of the
>     > channel (this is what 3552 describes as the Internet Threat model
>     > [0]).
>
> "Dolev-Yao" is a bit of a mouthful, but maybe if I say it really fast as if
> it's the name of a Kata it will work for me :-)
>

I agree. It might be useful to create a new name, as long as we are careful
to have
a precise definition.


>     > However, it's also useful to try to consider more limited
>     > attackers such as those who can only read from the wire and those who
>     > cannot remove packets. To my knowledge, we don't have a consensus set
>     > of precise definitions for these yet, though both 3552 and QUIC [1]
>     > make a stab at this). Similarly, some attacks are well-defined
>     > (reflection, identity misbinding, KCI, impersonation etc.) and some
> are
>     > not.
>
> The QUIC 21.13.3.1 "on-path" attacker seems to be a Dolev-Yao attacker.
>
> The 21.13.3.2 "off-path" attacker seems to have the ability to observe
> packets, which I normally would not think an off-path attacker would have.
> So this definition is very surprising to me.
>

I agree it's not ideal. QUIC has been pubreq-ed, so you could raise it in
IETF-LC.

-Ekr

RFC7416 has some terms (sinkhole, wormhole) that might be useful.
> I notice that sections 21.13.3.4 about how an off-path could become on-path
> by offering "better" routing.
>
> Perhaps this is worth an hour of IETF109 SAAG time.
>



> --
> Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
>            Sandelman Software Works Inc, Ottawa and Worldwide
>
>