Re: [Sidrops] what to do when the CRL is hosed?

[Lukas Tribus <[e-mail]>]

Hello Randy,

On Fri, 3 Apr 2020 at 02:28, Randy Bush <[e-mail]> wrote:
>
> > - no MITM attacks possible that lead to incomplete VRP sets (with the
> >   supported retrieval methods, which still includes rsync)
>
> you are asking for transport security.  we chose not to take that path.
> if an evil monkey gets in the middle, it should be detectable.  but the
> design does not prevent mitm.

What I'm trying to say is something different:

We promised transport agnostic security. I'm asking that we maintain
that promise.


But if we are unable to maintain that promise and start relying on
transport security, then we need to actually fully admit that and drop
rysnc.

This is because I read some arguments on this list akin to "well this
attack will not work against RRDP, so only rsync ...". What I am
saying is that: we should maintain the same guarantees and
consistencies at the end of the day with both retrieval methods.


I understand MITM - as in denying the *entire* service - is an attack
that affects both retrieval methods. That's ok. What would be
unacceptable for me is that a repository retrieved via rsync could be
affected by a partial withhold attack, withholding some VRP's.


The TL;DR here is, as a network operator, I expect both retrieval
methods to provide the same kind of assurances, consistencies and
security guarantees. On the other hand, if rsync is a second class
citizen, then we need big fat warnings about rsync.


Lukas