Re: [secdir] Fwd: [Last-Call] Secdir last call review of draft-ietf-capport-rfc7710bis-04

[Erik Kline <[e-mail]>]

For the record: trying to improve text over on
https://github.com/capport-wg/7710bis/pull/31 .

On Sun, May 10, 2020 at 9:52 PM Benjamin Kaduk <[e-mail]> wrote:
>
> [adding back some lists]
>
> -Ben
>
> On Wed, May 06, 2020 at 02:37:39PM +1000, Martin Thomson wrote:
> > What does "extra cautious" mean?  I assume that this is intended to apply to what a human might do, further implying that there is a role for a human decision.
> >
> > None of this architecture requires the involvement of a human in this way. Nor do I think that there is any meaningful distinction between an opaque string of characters (that might include confusables) and an opaque string of digits.
> >
> > I appreciate the sentiment here, but the fundamental problem is that once you decide that this information is not from the network, it is useless. If it is from the network, it is only of limited use. That use cannot depend on the identity of the server, so there is no value in any sort of caution.
> >
> > On Wed, May 6, 2020, at 13:36, Benjamin Kaduk wrote:
> > > [My unicast reminder got a unicast reply; forwarding to someplace at least
> > > vaguely useful.]
> > >
> > > -Ben
> > >
> > > On Tue, May 05, 2020 at 07:57:14PM -0400, Rifaat Shekh-Yusef wrote:
> > > > Thanks for the reminder Ben.
> > > >
> > > > Erik,
> > > >
> > > > Since this document allows the use of IP address to represent the portal
> > > > URI, I think it would important to add some text that explicitly states
> > > > that the user might be presented with an IP address instead of the hostname
> > > > of the API, and in that case the user should be extra cautious when this
> > > > happens.
> > > >
> > > > Regards,
> > > >  Rifaat
> > > >
> > > >
> > > >
> > > >
> > > > On Tue, May 5, 2020 at 7:30 PM Benjamin Kaduk <[e-mail]> wrote:
> > > >
> > > > > Hi Rifaat,
> > > > >
> > > > > I just wanted to follow-up and check that you had received Erik's question.
> > > > >
> > > > > Thanks,
> > > > >
> > > > > Ben
> > > > >
> > > > > On Sun, May 03, 2020 at 02:58:29PM -0700, Erik Kline wrote:
> > > > > > Rifaat,
> > > > > >
> > > > > > Thanks for your reading of the document.
> > > > > >
> > > > > > The security section has a paragraph that begins:
> > > > > >
> > > > > > """
> > > > > >    An attacker with the ability to inject DHCP messages or RAs could
> > > > > >    include an option from this document to force users to contact an
> > > > > >    address of his choosing.  As an attacker with this capability could
> > > > > >    simply list himself as the default gateway (and so intercept all the
> > > > > >    victim's traffic); this does not provide them with significantly more
> > > > > >    capabilities, but because this document removes the need for
> > > > > >    interception, the attacker may have an easier time performing the
> > > > > >    attack...
> > > > > > """
> > > > > >
> > > > > > Do you have any specific ideas for what text might be added to clarify
> > > > > vis.
> > > > > > your concern?  Would a sentence that captures your "the use of TLS and
> > > > > > presenting the identity in the certificate might not be of much help"
> > > > > > observation suffice?
> > > > > >
> > > > > > Thanks,
> > > > > > -Erik
> > > > > >
> > > > > > On Fri, 1 May 2020 at 05:10, Rifaat Shekh-Yusef via Datatracker <
> > > > > > [e-mail]> wrote:
> > > > > >
> > > > > > > Reviewer: Rifaat Shekh-Yusef
> > > > > > > Review result: Has Issues
> > > > > > >
> > > > > > > Since the use of IP address literal is not forbidden by this document,
> > > > > > > what if
> > > > > > > an attacker with the ability to inject DHCP messages or RAs uses this
> > > > > > > option
> > > > > > > to force the user to contact an IP address of his choosing? In this
> > > > > case,
> > > > > > > the use
> > > > > > > of TLS and presenting the identity in the certificate might not be of
> > > > > much
> > > > > > > help.
> > > > > > >
> > > > > > > I think this case should be discussed in the security consideration
> > > > > > > section.
> > > > > > >
> > > > > > >
> > > > > > >
> > > > >
> > > > > > --
> > > > > > last-call mailing list
> > > > > > [e-mail]
> > > > > > https://www.ietf.org/mailman/listinfo/last-call
> > > > >
> > > > >
> > >