Subject: [secdir] secdir review of draft-ietf-decade-problem-statement-05

From: Leif Johansson <[email-masked]>
Date: Sun, 11 Mar 2012 21:39:16 +0100

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the
security area directors.  Document editors and WG chairs should treat
these comments just like any other last call comments.

My main problem with the draft is that the Security Considerations
Section is weak. I would have liked a more in-depth analysis of the
enumerated threats in the context of decade. For instance the privacy
aspects of using in-network storage for P2P networks is only covered
briefly as part of a discussion on traffic analysis.

Also in section 3.2 it is noted that E2E encryption may render P2P
caches ineffective. This speaks to a fundamental flaw (imo) in the
architecture: the standard way to protect against many of the stated
attacks also leads to inefficiency of decade. At the very least the
document needs to call this issue out clearly.

	Cheers Leif

---

From: Songhaibin <[email-masked]>
Date: Thu, 22 Mar 2012 07:44:01 +0000

Thank you Leif,

> briefly as part of a discussion on traffic analysis.

Because many of the security threats are not very special compared to other client-server interactions, so we did not give much analysis there, but only quote the potential threats here. But we will try to think a little more deeper.

> document needs to call this issue out clearly.

You are right. But this issue seems to be better covered in the architecture document than this one.

BR,
-Haibin

> -----Original Message-----
> From: Leif Johansson [mailto:[email-masked]]
> Sent: Monday, March 12, 2012 4:39 AM
> To: [email-masked]; [email-masked];
> [email-masked]
> Subject: secdir review of draft-ietf-decade-problem-statement-05
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
> 
> iEYEARECAAYFAk9dDXQACgkQ8Jx8FtbMZndzfQCdGlV5Vun5Khv9doeYdcjebALX
> ++EAn0VVTjtEMsDlFFM86NlWC+pRlr7X
> =Ob4+
> -----END PGP SIGNATURE-----

---

From: Leif Johansson <[email-masked]>
Date: Thu, 22 Mar 2012 11:36:59 +0100

On 03/22/2012 08:44 AM, Songhaibin wrote:
> Thank you Leif,
> 
>> My main problem with the draft is that the Security
>> Considerations Section is weak. I would have liked a more
>> in-depth analysis of the enumerated threats in the context of
>> decade. For instance the privacy aspects of using in-network
>> storage for P2P networks is only covered briefly as part of a
>> discussion on traffic analysis.
> 
> Because many of the security threats are not very special compared
> to other client-server interactions, so we did not give much
> analysis there, but only quote the potential threats here. But we
> will try to think a little more deeper.
> 

I think thats where we disagree. My argument is that since some of
the architecture is invalidated by common solutions to the usual
threat vectors (eg e2e encryption).

	Cheers Leif

---

From: Songhaibin <[email-masked]>
Date: Thu, 22 Mar 2012 11:40:45 +0000

Hi Leif,

I do not say your suggestion is wrong. Instead, I think your comment is very reasonable. I say this is the problem statement draft, I admit we are going to dig a little deeper with the potential threats in our context (without an architecture as the basis), but these threats are not going to be solved here, they will be considered when designing the architecture document.

BR,
-Haibin

> Sent: Thursday, March 22, 2012 6:37 PM
> To: Songhaibin
> Cc: [email-masked]; [email-masked];
> [email-masked]
> Subject: Re: secdir review of draft-ietf-decade-problem-statement-05
> 
> iEYEARECAAYFAk9rAMYACgkQ8Jx8FtbMZndKTQCfRPosiDyR8qVxzVv5mxOCZybE
> 7ggAnjrKN/BC5ZL5F5I/5griYLcwnTa/
> =dAdC

---

From: Leif Johansson <[email-masked]>
Date: Thu, 22 Mar 2012 12:52:48 +0100

On 03/22/2012 12:40 PM, Songhaibin wrote:
> Hi Leif,
> 
> I do not say your suggestion is wrong. Instead, I think your
> comment is very reasonable. I say this is the problem statement
> draft, I admit we are going to dig a little deeper with the
> potential threats in our context (without an architecture as the
> basis), but these threats are not going to be solved here, they
> will be considered when designing the architecture document.
> 

I'm not asking for solutions in the problem statement draft but
a clear statement that the problems exist and need to be solved.

I could not see that in the current draft, in particular wrt
the issue I raised.

	Cheers Leif

---

From: David Harrington <[email-masked]>
Date: Thu, 22 Mar 2012 08:56:21 -0400

Hi,

I think the problem is "security issues are part of the problem", not just
part of the solution.

The threats associated with in-network storage should be identified as
part of the problem.
The need to mitigate the threats is part of the requirements.
How to mitigate those threats is part of the solution.

--
David Harrington
Director, Transport Area
Internet Engineering Task Force (IETF)
[email-masked]
+1-603-828-1401

On 3/22/12 7:40 AM, "Songhaibin" <[email-masked]> wrote:

>Hi Leif,
>
>I do not say your suggestion is wrong. Instead, I think your comment is
>very reasonable. I say this is the problem statement draft, I admit we
>are going to dig a little deeper with the potential threats in our
>context (without an architecture as the basis), but these threats are not
>going to be solved here, they will be considered when designing the
>architecture document.
>
>BR,
>-Haibin
>