Re: [Sidrops] what to do when the CRL is hosed?

Hi,

> On 3 Apr 2020, at 09:32, Lukas Tribus <lists@ltri.eu> wrote:
> 
> Hello Randy,
> 
> On Fri, 3 Apr 2020 at 02:28, Randy Bush <randy@psg.com> wrote:
>> 
>>> - no MITM attacks possible that lead to incomplete VRP sets (with the
>>>  supported retrieval methods, which still includes rsync)
>> 
>> you are asking for transport security.  we chose not to take that path.
>> if an evil monkey gets in the middle, it should be detectable.  but the
>> design does not prevent mitm.
> 
> What I'm trying to say is something different:
> 
> We promised transport agnostic security. I'm asking that we maintain
> that promise.
> 
> 
> But if we are unable to maintain that promise and start relying on
> transport security, then we need to actually fully admit that and drop
> rysnc.
> 
> This is because I read some arguments on this list akin to "well this
> attack will not work against RRDP, so only rsync ...". What I am
> saying is that: we should maintain the same guarantees and
> consistencies at the end of the day with both retrieval methods.
> 
> 
> I understand MITM - as in denying the *entire* service - is an attack
> that affects both retrieval methods. That's ok. What would be
> unacceptable for me is that a repository retrieved via rsync could be
> affected by a partial withhold attack, withholding some VRP's.
> 
> 
> The TL;DR here is, as a network operator, I expect both retrieval
> methods to provide the same kind of assurances, consistencies and
> security guarantees. On the other hand, if rsync is a second class
> citizen, then we need big fat warnings about rsync.

I believe that TLS Verification for RRDP MUST become mandatory. No, it's not perfect, it's not a replacement for the *object* security that exists in RPKI, but it's an additional check. In particular it can help to flag if an RP is misdirected or a MITM might be in play.

With regards to phasing out rsync. I tried to start that discussion at IETF 106, and made an initial write-up:
https://datatracker.ietf.org/doc/draft-sidrops-bruijnzeels-deprecate-rsync/

I have not yet asked for WG adoption - I forgot in the midst of lots of other work etc. That said, I can do so. I am happy to accept co-authors as well. My impression from the room (not wanting to put on any chair hats) is that there is no strong opposition to phasing out rsync.

However, this discussion is somewhat orthogonal to what RPs should do in case they find issues with a MFT, CRL, or know that there are objects that are missing. These problems exist regardless of the transport.

Tim

> 
> 
> Lukas
> 
> _______________________________________________
> Sidrops mailing list
> Sidrops@ietf.org
> https://www.ietf.org/mailman/listinfo/sidrops