Re: [Smart] [Secdispatch] New Version Notification for draft-lazanski-smart-users-internet-00.txt

[Eric Rescorla <[e-mail]>]

On Mon, Jul 15, 2019 at 1:11 AM Eliot Lear <[e-mail]> wrote:

> Hi Eric,
>
> On 14 Jul 2019, at 23:24, Eric Rescorla <[e-mail]> wrote:
>
> Similarly, I don't think that the kinds of botnet attacks described
> in Section 3 are out of scope for 3552, though I see how it could
> be read this way. However I think that the idea of a malicious
> counterparty is clearly in scope if we assume that the attacker
> controls the network.
>
>
>
> When you say “network” do you mean the botnet or the wired network
> connecting devices?
>

Well, from the perspective of the receiver of traffic, these are kind of
the same thing, because you're just receiving packets.

I agree it's a bit of an awkward fit, and I wish 3552 talked more about
compromised counterparties -- this is mostly due to my comsec orientation,
I agree -- but I'm not sure that it would change what work we do...

-Ekr

 The former is where I and most people would argument most of the trouble
> stems from: since a great many attacks are coming from batted devices.  I
> seem to recall that we shut down a botnet some time ago that had more
> devices than all of the Internet infrastructure at all major carriers
> combined (it was in the millions).
>



>
> Here too, I wouldn't expect 3552 to be deployed
> to preclude that kind of work; we have done plenty of anti-DoS work
> in IETF (whether it is good enough is a different story).
>
>
>
> And I would expand that to cover not just DoS, but other forms of attack.
>
> To your point on the E in IETF, I agree that there needs to be clarity on
> what E is needed. As I wrote elsewhere, I would be happy with quite a bit
> more R from the sister organization.
>
> Eliot
>
>