Re: [secdir] Fwd: [Last-Call] Secdir last call review of draft-ietf-capport-rfc7710bis-04

Barry Leiba <barryleiba@computer.org> Wed, 13 May 2020 16:29 UTC

Return-Path: <barryleiba@gmail.com>
X-Original-To: secdir@ietfa.amsl.com
Delivered-To: secdir@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C41AC3A0E49; Wed, 13 May 2020 09:29:07 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.399
X-Spam-Level:
X-Spam-Status: No, score=-1.399 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FORGED_FROMDOMAIN=0.25, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.25, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YhQ4oAQbLOrS; Wed, 13 May 2020 09:29:06 -0700 (PDT)
Received: from mail-il1-f177.google.com (mail-il1-f177.google.com [209.85.166.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8E6DE3A0DA4; Wed, 13 May 2020 09:29:03 -0700 (PDT)
Received: by mail-il1-f177.google.com with SMTP id e8so252672ilm.7; Wed, 13 May 2020 09:29:03 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=XjYG4YNM45AW4STTQHldGUEiqmaHvYEYn79pGIbRLhc=; b=HOu6N3S80UxRfGhi8Y2cmGf0HjBLxIYnH4lmsmCBPy3BiZNcZRZwBpXydldBgp4rYe P7yCvid/kW5nYKC5RwEHUL+UYhKLuwCkBF2JqAMCUv6l1NAokMjmIHW1l7QvPlJ8DzxD c/cL2z1ccEURwKxfLxBwcfS9L/TLChhI5319Yjenuscr78uFprv/KWQPip3e0QRUf+LH M4ATMxZ8kJQNDGbhtelGjTKgcCP8jHPHXIplqrdELg43xrkPDJ6XmR2aiI+7PYLhED/6 I7N8WrewDYdvtTqJ34mZ0EVzWQmgNL5SGNCmmWIQkpwQ7e86jkVos9utT682WpOYPODt Mc+Q==
X-Gm-Message-State: AOAM530Gmr3TbwBaXaqL29/XGkegYSYeZMnbLjitagcfUmsI5OXEwQF0 53C4B5zSJcLY2xH+P/VW3jDVfh698Wp9+x+w1Ag=
X-Google-Smtp-Source: ABdhPJzdlW8NzDY8QTaXE936qRF4fq++h8bEgieOQ+JyhMEMh+VBYIiQFkl6jkY9U43l7DMLFc3a0d8LyZ0+DlfGxxM=
X-Received: by 2002:a92:dc0e:: with SMTP id t14mr299573iln.140.1589387342530; Wed, 13 May 2020 09:29:02 -0700 (PDT)
MIME-Version: 1.0
References: <85873c75-0d4d-4ec5-91a1-a28b92378ec3@www.fastmail.com> <20200511045150.GI27494@kduck.mit.edu> <CAMGpriW2-1FrmNz1egtHd=_ZdDtMhK6QMGAawsDO=EcCPsyavA@mail.gmail.com> <CAMGpriXpc=2xnya2Uy3zU_yv2fcmPs-qOP5iGxG9uWA9RwicnA@mail.gmail.com>
In-Reply-To: <CAMGpriXpc=2xnya2Uy3zU_yv2fcmPs-qOP5iGxG9uWA9RwicnA@mail.gmail.com>
From: Barry Leiba <barryleiba@computer.org>
Date: Wed, 13 May 2020 12:28:51 -0400
Message-ID: <CALaySJLbdkzHVKRnemShAdTs4u+GHrSW39vdVKbYrLfFRXdxsg@mail.gmail.com>
To: Erik Kline <ek.ietf@gmail.com>
Cc: Benjamin Kaduk <kaduk@mit.edu>, Martin Thomson <mt@lowentropy.net>, Rifaat Shekh-Yusef <rifaat.ietf@gmail.com>, Erik Kline <ek@loon.com>, draft-ietf-capport-rfc7710bis.all@ietf.org, captive-portals <captive-portals@ietf.org>, IETF SecDir <secdir@ietf.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://mailarchive.ietf.org/arch/msg/secdir/Kv92T0fPztDrLlvzf3hHmOrS9ZY>
Subject: Re: [secdir] Fwd: [Last-Call] Secdir last call review of draft-ietf-capport-rfc7710bis-04
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/secdir/>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 13 May 2020 16:29:12 -0000

Erik, is there a revised I-D coming for this?

Thanks,
Barry

On Mon, May 11, 2020 at 1:09 AM Erik Kline <ek.ietf@gmail.com> wrote:
>
> Gah! Sorry, I didn't mean to imply that the conversation should be
> moved there.  Only pointing to text-in-progress for your review.
>
> On Sun, May 10, 2020 at 10:08 PM Erik Kline <ek.ietf@gmail.com> wrote:
> >
> > For the record: trying to improve text over on
> > https://github.com/capport-wg/7710bis/pull/31 .
> >
> > On Sun, May 10, 2020 at 9:52 PM Benjamin Kaduk <kaduk@mit.edu> wrote:
> > >
> > > [adding back some lists]
> > >
> > > -Ben
> > >
> > > On Wed, May 06, 2020 at 02:37:39PM +1000, Martin Thomson wrote:
> > > > What does "extra cautious" mean?  I assume that this is intended to apply to what a human might do, further implying that there is a role for a human decision.
> > > >
> > > > None of this architecture requires the involvement of a human in this way. Nor do I think that there is any meaningful distinction between an opaque string of characters (that might include confusables) and an opaque string of digits.
> > > >
> > > > I appreciate the sentiment here, but the fundamental problem is that once you decide that this information is not from the network, it is useless. If it is from the network, it is only of limited use. That use cannot depend on the identity of the server, so there is no value in any sort of caution.
> > > >
> > > > On Wed, May 6, 2020, at 13:36, Benjamin Kaduk wrote:
> > > > > [My unicast reminder got a unicast reply; forwarding to someplace at least
> > > > > vaguely useful.]
> > > > >
> > > > > -Ben
> > > > >
> > > > > On Tue, May 05, 2020 at 07:57:14PM -0400, Rifaat Shekh-Yusef wrote:
> > > > > > Thanks for the reminder Ben.
> > > > > >
> > > > > > Erik,
> > > > > >
> > > > > > Since this document allows the use of IP address to represent the portal
> > > > > > URI, I think it would important to add some text that explicitly states
> > > > > > that the user might be presented with an IP address instead of the hostname
> > > > > > of the API, and in that case the user should be extra cautious when this
> > > > > > happens.
> > > > > >
> > > > > > Regards,
> > > > > >  Rifaat
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > > On Tue, May 5, 2020 at 7:30 PM Benjamin Kaduk <kaduk@mit.edu> wrote:
> > > > > >
> > > > > > > Hi Rifaat,
> > > > > > >
> > > > > > > I just wanted to follow-up and check that you had received Erik's question.
> > > > > > >
> > > > > > > Thanks,
> > > > > > >
> > > > > > > Ben
> > > > > > >
> > > > > > > On Sun, May 03, 2020 at 02:58:29PM -0700, Erik Kline wrote:
> > > > > > > > Rifaat,
> > > > > > > >
> > > > > > > > Thanks for your reading of the document.
> > > > > > > >
> > > > > > > > The security section has a paragraph that begins:
> > > > > > > >
> > > > > > > > """
> > > > > > > >    An attacker with the ability to inject DHCP messages or RAs could
> > > > > > > >    include an option from this document to force users to contact an
> > > > > > > >    address of his choosing.  As an attacker with this capability could
> > > > > > > >    simply list himself as the default gateway (and so intercept all the
> > > > > > > >    victim's traffic); this does not provide them with significantly more
> > > > > > > >    capabilities, but because this document removes the need for
> > > > > > > >    interception, the attacker may have an easier time performing the
> > > > > > > >    attack...
> > > > > > > > """
> > > > > > > >
> > > > > > > > Do you have any specific ideas for what text might be added to clarify
> > > > > > > vis.
> > > > > > > > your concern?  Would a sentence that captures your "the use of TLS and
> > > > > > > > presenting the identity in the certificate might not be of much help"
> > > > > > > > observation suffice?
> > > > > > > >
> > > > > > > > Thanks,
> > > > > > > > -Erik
> > > > > > > >
> > > > > > > > On Fri, 1 May 2020 at 05:10, Rifaat Shekh-Yusef via Datatracker <
> > > > > > > > noreply@ietf.org> wrote:
> > > > > > > >
> > > > > > > > > Reviewer: Rifaat Shekh-Yusef
> > > > > > > > > Review result: Has Issues
> > > > > > > > >
> > > > > > > > > Since the use of IP address literal is not forbidden by this document,
> > > > > > > > > what if
> > > > > > > > > an attacker with the ability to inject DHCP messages or RAs uses this
> > > > > > > > > option
> > > > > > > > > to force the user to contact an IP address of his choosing? In this
> > > > > > > case,
> > > > > > > > > the use
> > > > > > > > > of TLS and presenting the identity in the certificate might not be of
> > > > > > > much
> > > > > > > > > help.
> > > > > > > > >
> > > > > > > > > I think this case should be discussed in the security consideration
> > > > > > > > > section.
> > > > > > > > >
> > > > > > > > >
> > > > > > > > >
> > > > > > >
> > > > > > > > --
> > > > > > > > last-call mailing list
> > > > > > > > last-call@ietf.org
> > > > > > > > https://www.ietf.org/mailman/listinfo/last-call
> > > > > > >
> > > > > > >
> > > > >