Subject: [OPSAWG] FYI- Executive Order on SBOMs- draft-ietf-opsawg-sbom-access

From: Eliot Lear <[email-masked]>
Date: Mon, 17 May 2021 11:09:05 +0200

For those not keeping score, SBOMs are entering the world of regulation.  US President Joe Biden issued an executive order,[1] Section 4 of which focuses on supply chain security, and SBOMs.  One of the key aspects will be how that information is shared.  NIST, NTIA, and DHS will play a big role.

Eliot

[1] https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/

---

From: Michael Richardson <[email-masked]>
Date: Mon, 17 May 2021 06:03:19 -0400

Eliot Lear <lear=[email-masked]> wrote:
    > For those not keeping score, SBOMs are entering the world of
    > regulation.  US President Joe Biden issued an executive order,[1]
    > Section 4 of which focuses on supply chain security, and SBOMs.  One of
    > the key aspects will be how that information is shared.  NIST, NTIA,
    > and DHS will play a big role.

What should the IETF do?

Things I can think about:
1) Ask Allen Friedman to do an IAB Tech presentation

2) Be clear about what core technologies from the IETF are being leveraged.

3) Find a replacement for MAC addresses as primary key to identify specific
   devices

4) How do our incident reporting protocols preserve or do not preserve
   privacy?  Once we have better supply chain security, then we will have
   better and clearer statements about vulnerabilities.  How does this
   translate back to reports about specific devices?
   How can an ISP gauge the extent of their vulnerability without actually
   having an inventory of devices?
   (I think Bloom filters have some role here)

--
Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide

---

From: Eliot Lear <[email-masked]>
Date: Mon, 17 May 2021 12:08:26 +0200

Hi Michael,

> On 17 May 2021, at 12:03, Michael Richardson <[email-masked]> wrote:
> 
> 

I think we’re doing a lot of what we should be doing: finding a means to facilitate information sharing.

> 1) Ask Allen Friedman to do an IAB Tech presentation

Why not?

> 2) Be clear about what core technologies from the IETF are being leveraged.

You bet.

> 3) Find a replacement for MAC addresses as primary key to identify specific

Not sure how this applies.

>   (I think Bloom filters have some role here)

Good question.

Eliot

---

From: Michael Richardson <[email-masked]>
Date: Mon, 17 May 2021 09:09:44 -0400

Eliot Lear <[email-masked]> wrote:
    >> 3) Find a replacement for MAC addresses as primary key to identify
    >> specific devices

    > Not sure how this applies.

If MAC addresses become regularly randomized, then what is the unique handle
for each device?   While some devices might not randomize their MAC address,
the fact that some do forces management systems to adapt.
I think that the answer is in the shape of hash of public (IDevID) key.

    >> translate back to reports about specific devices?  How can an ISP
    >> gauge the extent of their vulnerability without actually having an
    >> inventory of devices?  (I think Bloom filters have some role here)

---

From: Alan DeKok <[email-masked]>
Date: Mon, 17 May 2021 09:17:36 -0400

> I think that the answer is in the shape of hash of public (IDevID) key.

  The answer in much of the AAA space is "client cert", which is partially the same thing.

  For people who want actual MAC addresses, they can leverage the ID in the client cert to look up a server-side table of ID to MAC.  Or they can use RFCC 6677 channel bindings.  https://datatracker.ietf.org/doc/html/rfc6677

  This presumes that the devices are using TLS-based EAP methods in order to authenticate to the network.  As time goes on, this seems to be not only more widely true, but also more widely recommended.

  Alan DeKok.

---

From: Michael Richardson <[email-masked]>
Date: Mon, 17 May 2021 11:21:07 -0400

Alan DeKok <[email-masked]> wrote:
    >   This presumes that the devices are using TLS-based EAP methods in
    > order to authenticate to the network.  As time goes on, this seems to
    > be not only more widely true, but also more widely recommended.

That's where I think we have to go, but I think that there is a lot of
pushback towards maintaining WPA-PSK.