Re: [secdir] Secdir review of draft-ietf-ippm-6man-pdm-option-05: Timing Attacks

["MORTON, ALFRED C (AL)" <[e-mail]>]

Hi Nalini and Tero,
Allow me to make two editorial suggestions.
(see below)
Al

> -----Original Message-----
> From: Tero Kivinen [mailto:[e-mail]]
> Sent: Tuesday, January 10, 2017 7:05 AM
> To: [e-mail]
> Cc: [e-mail]; [e-mail]; draft-ietf-ippm-6man-pdm-
> [e-mail]
> Subject: Re: Secdir review of draft-ietf-ippm-6man-pdm-option-05: Timing
> Attacks
> 
> [e-mail] writes:
> > Tero,
> >
> > I believe this is the last outstanding issue!  After we reach
> > agreement, I will rewrite the draft to:
> ...
> > 8.4 Timing Attacks
> >
> > The fact that PDM can help in the separation of node processing time
> > from network latency brings value to performance monitoring.  Yet,
> > it is this very characteristic of PDM which may be misused to make
> > certain new type of timing attacks against protocols and
> > implementations possible.
> >
> > That is, in some cases, depending on the nature of the cryptographic
> > protocol used, it may be possible to leak the long term credentials
> > of the device.  For example, if and attacker is able to create an
> attack
> > which causes the enterprise to turn on PDM to diagnose the attack,
> > then the attacker might use PDM during that debugging time to launch
> > a timing attack against the long term keying material used by the
> > cryptographic protocol.
> >
> > An implementation may want to be sure that PDM is enabled only for
> > certain ip addresses, or only for some ports.  Additionally, we
> > recommend that the implementation SHOULD require an explicit
> > restart of monitoring after a certain timeperiod (for example for 1
> hour),
> > to make sure that PDM is not accidently left on after
> > debugging has been done etc.
> >
> > Even so, if using PDM, we introduce the concept of user "Consent to
> > be Measured" as a pre-requisite for using PDM.  Consent is common in
> > enterprises and with some subscription services. So, if with PDM, we
> > recommend that the user SHOULD consent to its use.
> 
> This new text looks good.
> --
> [e-mail]
[ACM] 
OLD
> That is, in some cases, depending on the nature of the cryptographic 
> protocol used, it may be possible to leak the long term credentials 
> of the device.  For example, if and attacker is able to create an attack
NEW
Depending on the nature of the cryptographic 
protocol used, it may be possible to leak the long term credentials 
of the device.  For example, if an attacker is able to create an attack
                                ^^
...

Thanks for your extensive efforts to resolve these issues!
Al
doc shepherd