Subject: re: [ippm] IESG review of draft-ietf-ippm-owdp-reqs-

From: Allison Mankin <[email-masked]>
Date: Tue, 18 Mar 2003 08:57:45 -0800

Hi,

It took some time for Steve Bellovin to re-review the issues here.  We will
go forward with approval with one RFC-Editor note that you must submit to me
ASAP (not waiting so long this time :) and the protocol document must take into
account the timestamp protection issue that Steve raised in his comments and that
you did not consider here.

The RFC Editor note is as follows - where you mention authentication, authorization
should also be explicitly brought in too.

Allison

> ------- Forwarded Message
> 
> 
> http://www.internet2.edu/~shalunov/ippm/draft-ietf-ippm-owdp-reqs-05.txt
> has been submitted to the internet-drafts repository.
> 
> Its purpose is to address replay attack issues raised in Steve
> Bellovin's security review.
> 
> To save you the trouble of digging it out and running diff, the
> following substantially new text was included:
> 
> 6.6. Replay Attacks
> 
>    OWAMP-Control must be resistant to any replay attacks.
> 
>    OWAMP-Test, on the other hand, is a protocol for network measurement.
>    One of the attributes of networks is packet duplication.  OWAMP-Test
>    has to be suitable for measurement of duplication.  This would make
>    it vulnerable to attacks that involve replaying a recent packet.  For
>    the recipient of such a packet it is impossible to determine whether
>    the duplication is malicious or naturally occurring.
> 
>    OWAMP-Test should measure all duplication -- malicious or otherwise.
>    Note that this is similar to delay attacks: an attacker can hold up a
>    packet for some short period of time and then release it to continue
>    on its way to the recipient.  There's no way such delay can be
>    reliably distinguished from naturally occuring delay by the
>    recipient.
> 
>    OWAMP-Test should measure the network as it was.  Note, however, that
>    this does not prevent the data from being sanitized at a later stage
>    of processing, analysis, or consumption.  Some sanity checks (those
>    that are deemed reliable and erring on the side of inclusion) should
>    be performed by OWAMP-Test recipient immediately.
> 
> ------- End of Forwarded Message
> 
_______________________________________________
ippm mailing list
[email-masked]
http://mailhost.advanced.org/mailman/listinfo/ippm

---

From: stanislav shalunov <[email-masked]>
Date: 18 Mar 2003 13:50:01 -0500

Allison Mankin <[email-masked]> writes:

> We will go forward with approval with one RFC-Editor note that you
> must submit to me ASAP (not waiting so long this time :)

Sorry about that.  I'll provide quicker turnaround this time.
http://www.internet2.edu/~shalunov/ippm/draft-ietf-ippm-owdp-reqs-06.txt
differs from the previous version (-05) as follows (omitting data and
version number differences):

@@ -406,7 +406,7 @@
 concurrent and subsequent OWAMP-Test traffic.)
 
 .Pb
-Authentication
+Authentication and Authorization
 
 It should be possible to authenticate peers to each other using a user
 ID and a shared secret.  It should be infeasible for any external
@@ -417,6 +417,13 @@
 obtained by observing, modifying or initiating protocol transactions
 to impersonate (other) valid users.
 
+Authorization shall normally be performed on the basis of the
+authenticated identity.  For some lower security environments, it
+might be appropriate to have authorization that is partially based on
+the OWAMP-Control client IP address.  The authorization and other
+policy issues shall be deferred by the specification to the
+implementors as much as possible.
+

Does this adequately address the note?  Or is that extra paragraph too
much and I should have just changed the heading `Authentication' to
`Authentication and Authorization'.

> and the protocol document must take into account the timestamp
> protection issue that Steve raised in his comments and that you did
> not consider here.

OK.

-- 
Stanislav Shalunov		http://www.internet2.edu/~shalunov/

This time, [...], Americans know in our stomachs what that means.
				--Bill Keller in NYT op-ed, 20030222
_______________________________________________
ippm mailing list
[email-masked]
http://mailhost.advanced.org/mailman/listinfo/ippm

---

From: Allison Mankin <[email-masked]>
Date: Tue, 18 Mar 2003 13:39:39 -0800

Hi,

Definitely it would not be enough to just change the title of the Section.

The last two sentences are not actually ok - the requirement by the
Security area are that the test injection have a default stance of
authorization and that the standard be supportive of encouragement of
a specific approach to authorization.

Possibly you mean by your last sentence that use of authorization (policy)
is up to the implementor of the tests.  This is certainly true.  Only
implementation of a particular authentication/authorization mechanism would
be standardized, not use.

Allison

---

From: stanislav shalunov <[email-masked]>
Date: 18 Mar 2003 16:57:30 -0500

> be standardized, not use.

Would the following text work better?  (This would be instead of the
paragraph inserted in -06.)

Authorization shall normally be performed on the basis of the
authenticated identity (username) and the specification shall require
all implementations to support such a mode of authorization.
Different identities (or classes of identities) can have different
testing priviliges.  For some lower security environments, it might be
appropriate to have authorization that is partially based on the
OWAMP-Control client IP address.  The specification shall allow
implementations to use this authorization mechanism where the user
deems it appropriate.  The use of authorization for arriving at
specific policy decisions (such as whether to allow a specific test
with a specific source and destination and with a given test send
schedule -- which would determine the average network capacity
utilization -- at a given time) is up to the users.

OWAMP servers are encouraged to allow for a certain amount of
anonymous use, where any party can initiate any test that consumes
sufficiently small amounts of resources (network capacity, disk space,
etc.).  To prevent denial-of-service attacks, it must be impossible to
use this facility to direct traffic at third parties that have not
explicitly asked for it.

This message is designed to be viewed at 600 dpi.
_______________________________________________
ippm mailing list
[email-masked]
http://mailhost.advanced.org/mailman/listinfo/ippm

---

From: "Merike Kaeo" <[email-masked]>
Date: Tue, 18 Mar 2003 15:20:18 -0800

I am ok with this new wording although I would change (username) to (such as
username) to more explicitly allow other means of identification.  In the
protocol specification there needs to be great care to ensure that some
anonymous tests can be done without serious security problems (mainly DoS
related).

- merike

---

From: stanislav shalunov <[email-masked]>
Date: 20 Mar 2003 18:47:50 -0500

Allison,

Would the following work as the RFC Editor note regarding
authorization?

New subsection (needs to be inserted before the `Integrity' subsection
and after the `Authentication' subsection with subsequent subsections
renumbered appropriately):

6.5. Authorization

   Authorization shall normally be performed on the basis of the
   authenticated identity (such as username) and the specification shall
   require all implementations to support such a mode of authorization.
   Different identities (or classes of identities) can have different
   testing priviliges.  The use of authorization for arriving at
   specific policy decisions (such as whether to allow a specific test
   with a specific source and destination and with a given test send
   schedule -- which would determine the average network capacity
   utilization -- at a given time) is up to the users.

If convenient, nroff source might be useful:
http://www.internet2.edu/~shalunov/ippm/draft-ietf-ippm-owdp-reqs.nroff
(to be compiled with `nroff -ms').

Clothes make the man.  Naked people have little or no influence on
society.                                             -- Mark Twain
_______________________________________________
ippm mailing list
[email-masked]
http://mailhost.advanced.org/mailman/listinfo/ippm