Re: [stir] WG Last Call Extended : Responses Needed (was Re: WG Last Call on draft-ietf-stir-threats-00.txt)

Jon:
This will do.

Penn Pfautz
AT&T Access Management
+1-732-420-4962

-----Original Message-----
From: Peterson, Jon [mailto:jon.peterson@neustar.biz]
Sent: Monday, February 03, 2014 9:17 PM
To: PFAUTZ, PENN L; stir@ietf.org
Subject: Re: [stir] WG Last Call Extended : Responses Needed (was Re: WG Last Call on draft-ietf-stir-threats-00.txt)

I've added these to a brief subsection before the attacks (there are now
three attacks that follow, including TDoS) which provides an introduction,
dividing attackers' techniques into your two categories, and then says
that "concrete attacks" based on those techniques are given in the
following sections. Good enough?

Jon Peterson
Neustar, Inc.

On 1/26/14, 7:41 AM, "PFAUTZ, PENN L" <pp3129@att.com> wrote:

>Thanks, Jon
>I'll defer to you on terminology. I do think that the attack sections 3.1
>and 3.2 should be made more generic along the lines I suggest:
>-impersonation to hide caller identity (e.g., in support of robocalling)
>-impersonation of the specific identity associated with the calling
>number (voicemail hacking, phishing)
>
>Penn Pfautz
>AT&T Access Management
>+1-732-420-4962
>-----Original Message-----
>From: Peterson, Jon [mailto:jon.peterson@neustar.biz]
>Sent: Friday, January 24, 2014 9:48 PM
>To: PFAUTZ, PENN L; stir@ietf.org
>Subject: Re: [stir] WG Last Call Extended : Responses Needed (was Re: WG
>Last Call on draft-ietf-stir-threats-00.txt)
>
>
>>I'd like to suggest a somewhat different taxonomy for the document:
>
>Thanks for these notes, Penn.
>
>>I think there is one basic threat:  delivery of a calling number that the
>>caller is not authorized to use.
>>This threat enables two kinds of attacks building on that threat:
>>-impersonation to hide caller identity (e.g., in support of robocalling)
>>-impersonation of the specific identity associated with the calling
>>number (voicemail hacking, phishing)
>
>I went through a spin on this document already with Steve Kent about what
>should be considered an ³attack² versus a ³threat² versus what have you. I
>take it in the security community these are terms with a particular
>meaning, and I tried to bring the text here into conformance with his
>guidance. I don¹t think we¹d say the ³threat² is the delivery of the
>calling number in that fashion; that¹s a technique used by attackers to
>accomplish their attacks.
>
>>I think the " Endpoints" section might be better called "Targets"
>
>In the architecture that the Actors section describes, endpoints originate
>calls and receive them, and so necessarily originators of calls aren¹t in
>that sense ³targets.² There goal of the Actors section is to explain who
>the all parties are that originate, forward, and receive calls, just so
>the Attacks and Attack Scenarios can refer to these.
>
>>Section 4.1 on solution specific attacks either needs to be expanded with
>>sufficient detail to be meaningful or else deleted before the document
>>can become and RFC.
>
>Here, agreed. I don¹t want to lose those bullet points though; maybe the
>right thing to do is to just say that these points are out of scope, but
>that future work should remember to consider issues like these.
>
>Jon Peterson
>Neustar, Inc.
>
>>Penn Pfautz
>>AT&T Access Management
>>+1-732-420-4962
>>
>>-----Original Message-----
>>From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Robert Sparks
>>Sent: Tuesday, January 21, 2014 12:14 PM
>>To: stir@ietf.org
>>Subject: [stir] WG Last Call Extended : Responses Needed (was Re: WG Last
>>Call on draft-ietf-stir-threats-00.txt)
>>
>>There have been no on-list responses to this last call.
>>We're extending it through this Friday, Jan 24.
>>
>>Please let us know that you've reviewed this document and believe it is
>>ready for publication, or if you have any issues that still need to be
>>resolved.
>>Capturing your review on list is important, even if it's just a "ready"
>>note.
>>
>>RjS
>>
>>
>>On 1/2/14, 11:46 AM, Russ Housley wrote:
>>> The authors have posted an updated Internet-Draft on the STIR threat
>>>model.  It can be found here:
>>>http://www.ietf.org/id/draft-ietf-stir-threats-00.txt.
>>>
>>> Is this document ready for the STIR WG to pass to the IESG, requesting
>>>publication as an Informational RFC?  Please provide your input on this
>>>mail list by end-of-business on 16 January 2014.  If you have issues or
>>>concerns, please tell us what changes to the document are necessary to
>>>resolve them.
>>>
>>> Russ
>>>
>>> _______________________________________________
>>> stir mailing list
>>> stir@ietf.org
>>> https://www.ietf.org/mailman/listinfo/stir
>>
>>_______________________________________________
>>stir mailing list
>>stir@ietf.org
>>https://www.ietf.org/mailman/listinfo/stir
>>_______________________________________________
>>stir mailing list
>>stir@ietf.org
>>https://www.ietf.org/mailman/listinfo/stir
>