Subject: [Ecrit] Review of draft-ietf-ecrit-security-threats-01.txt

From: Hannes Tschofenig <[email-masked]>
Date: Fri, 05 May 2006 00:11:15 +0200

Hi all,

here are some review comments for the 
draft-ietf-ecrit-security-threats-01.txt document.

* Avoid mentioning the working group name in the text. For example,

Change from:
"
    This document reviews the security threats associated with the two
    current work items of the ECRIT Working Group.  The first is the
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    marking of signalling messages to indicate that they are related to
    an emergency.  The second is the process of mapping from locations to
    Universal Resource Identifiers (URIs) pointing to Public Safety
    Answering Points (PSAPs).  This mapping occurs as part of the process
    of routing emergency calls through the IP network.  Based on the
    threats, this document establishes a set of security requirements for
    the the mapping protocol and for the handling of emergency-marked
    calls.
"

to:

"
    This document reviews the security threats associated with
    marking of signalling messages to indicate that they are related to
    an emergency and the process of mapping from locations to
    Universal Resource Identifiers (URIs) pointing to Public Safety
    Answering Points (PSAPs).  This mapping occurs as part of the process
    of routing emergency calls through the IP network.  Based on the
    threats, this document establishes a set of security requirements for
    the the mapping protocol and for the handling of emergency-marked
    calls.
"

Additional examples:

    Section 4
    describes some motivations of attackers in the context of ECRIT,
                                                              ^^^^^^

    Section 5 describes and illustrates the attacks that might be used,
    and Section 6 lists the security-related requirements that must be
    met if these attacks are to be mitigated.

Section 3:

    The ECRIT Working Group has two work items relating to the routing of
        ^^^^^^^^^^^^^^^^^^^^
    emergency calls to their proper destination.  The first is to enable
    entities along the signalling path to recognize that a particular
    signalling message is associated with an emergency call.  The ECRIT
                                                                  ^^^^^^
    Working Group is defining content that can be added to the signalling
    ^^^^^^^^^^^^^^
    messages, an emergency identifier, for this purpose.  Signalling
    containing the emergency identifier may be given priority treatment,
    special processing, and/or special routing.

    The first goal of emergency call routing is to ensure that any
    emergency call is routed to a PSAP.  Preferably the call is routed to
    the PSAP responsible for the caller's location, since misrouting
    consumes valuable time while the call taker locates and forwards the
    call to the right PSAP.  As described in [I-D.ecrit-requirements],
    mapping, the second ECRIT work item, is part of the process of
                 ^^^^^^^^^^^^^^^^^^^^^^
    achieving this preferable outcome.

Section 4:

    o  to divert emergency responders to non-emergency sites.  No attacks
       affecting the ECRIT Working Group's decisions on the emergency
                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
       identifier and mapping protocol have been identified that achieve
       this objective

6.  Security requirements relating to ECRIT work items
                           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ delete

Reason: The working group name is meaningless after some time. 
Furthermore, it does not make sense to refer to work items of the 
working group.

* Technical

Section 5.2.1:

    In an impersonation attack, the attacker induces the mapping client
    to direct its queries to a host under the attacker's control rather
    than the real mapping server.  Impersonation itself is an issue for
    mapping server discovery rather than for the mapping protocol
    directly.

Well, I am not sure. Authentication of the mapping server to the mapping 
client would help to detect whether you talk to a mapping server. 
Consider the HTTP protocol as an example. The FQDN -> IP address 
resolution using DNS is almost never secured (using DNSSEC). However, 
you often use server-to-client authentication as part of HTTPS.

Hence, I suggest to rewrite the sentence in such a way that it points to 
both aspects:
"
Impersonation of the server towards the client is an issue for mapping 
server discovery as well as for the security mechanisms provided by the 
mapping protocol.
"

* Technical:

Section 5.2.1:

    This section considers attacks intended to reduce the effectiveness
    of the emergency response system for all callers in a given area.  If
    the mapping operation is disabled, the immediate effect is to
    increase the probability that emergency calls are routed to the wrong
    PSAP.

If the mapping client cannot contact the mapping server then the it 
might not have a PSAP URI to start with unless we specify some failure 
handling mechanisms. Hence, I suggest to rewrite the sentence to:

"
    If
    the mapping operation is disabled, then the emergency caller's 
device might not have the correct PSAP URI. As a consequence, the 
probability that emergency calls are routed to the wrong PSAP is 
increased. In the worst case the emergency caller's device might not be 
able to obtain a PSAP URI at all. "

* Repetition:

Section 5.2.3:

    The attacker may be seeking the location of the caller
    (e.g., to effect a criminal attack).  The attacker may be seeking
    information that could be used to link an individual (the caller or
    someone else involved in the emergency) with embarrassing information
    related to the emergency (e.g., "Who did the police take away just
    now?").

I suggest to delete the first sentence.

* Wording:

2.  Terminology

    The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
    "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
    document are to be interpreted as described in [RFC2119], with the
    qualification that unless otherwise stated they apply to the design
    of the mapping protocol, not its implementation or application.
                              replace with 'usage'     ^^^^^^^^^^^^^

* Section titles: The RFC editor expects the initials of each word in 
the title to be written with capital letters.

A few examples:

3.  Marking, Mapping, and the Emergency Call Routing Process
4.  Objectives of Attackers
5.  Potential Attacks
5.1.  Attacks Involving the Emergency Identifier
5.2.  Attacks Against or Using the Mapping Process
etc.

Furthermore, I think the editor would appreciate the following changes 
in Section 6:

Change from:
"
  Attack: insertion of interfering messages.
          ^
"
to:
"
  Attack: Insertion of interfering messages.
          ^
"
etc.

* Section 5.2.1: Editorial

    The other possible attack is one where the the mapping server is
                                           ^^^^ remove one 'the'

    tricked into sending responses to the target of the attack through
    spoofing of the source address in the query.

* Abstract: Editorial:

    Based on the
    threats, this document establishes a set of security requirements for
    the the mapping protocol and for the handling of emergency-marked
    ^^^ delete

    calls.

Ciao
Hannes

_______________________________________________
Ecrit mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ecrit

---

From: "Tom-PT Taylor" <[email-masked]>
Date: Thu, 04 May 2006 21:33:36 -0400

Thanks for your careful review. A couple of responses inline.

> * Avoid mentioning the working group name in the text. For example,
...

[PTT] OK
> server discovery as well as for the security mechanisms provided by the 

[PTT] Guess it's a matter of point of view. I see discovery as the 
primary issue, but being able to detect impersonation is essential for 
any recovery to be possible, and may also discourage the attack. What I 
suggest I do is generalize the next sentence beyond your quotation. It 
currently reads:

"However, the mapping protocol may help to protect against
    acceptance of responses from an impersonating entity."

Perhaps it should read:

"However, the mapping protocol may allow impersonation to be detected, 
thereby preventing acceptance of responses from an impersonating entity 
and possibly triggering a more secure discovery procedure."
> able to obtain a PSAP URI at all. "
[PTT] OK
> I suggest to delete the first sentence.

[PTT] The first sentence describes a different motivation from the rest. 
Think of a victim of attempted rape who has escaped her attacker and is 
calling for help, while the attacker searches for her. The rest of the 
paragraph describes a moderately less nasty situation.
>                               replace with 'usage'     ^^^^^^^^^^^^^
[PTT] OK

> the title to be written with capital letters.
[PTT] OK, never noticed before. Differs from the convention in another 
SDO I edit for.

...
>   Attack: Insertion of interfering messages.
[PTT] That bothers me -- a colon separates parts of a sentence -- it 
doesn't begin a new one. I just finished telling someone else to use 
small letters in their I-D in this situation.

> * Section 5.2.1: Editorial
OK to the rest
...

---

From: Hannes Tschofenig <[email-masked]>
Date: Fri, 05 May 2006 09:06:21 +0200

Hi Tom,

thanks for your quick response.

Tom-PT Taylor wrote:
>> Well, I am not sure. Authentication of the mapping server to the 
>> mapping client would help to detect whether you talk to a mapping 
>> server. Consider the HTTP protocol as an example. The FQDN -> IP 
>> address resolution using DNS is almost never secured (using DNSSEC). 
>> However, you often use server-to-client authentication as part of HTTPS.
>>
>> Hence, I suggest to rewrite the sentence in such a way that it points 
>> to both aspects:
>> "
>> server discovery as well as for the security mechanisms provided by 
>> the mapping protocol.
>> "
> 
> 

Sounds good to me.

>> increased. In the worst case the emergency caller's device might not 
>> be able to obtain a PSAP URI at all. "
>>
> [PTT] OK
> 
>>
>> * Repetition:
>>
>> Section 5.2.3:
>>

Hmmm. That's not obvious from the first sentence. I slightly changed the 
  beginning of the second sentence to make it look different.
"
The attacker may be seeking the location of the caller (e.g., to effect 
a criminal attack). Additionally, the adversary might want to collect 
information that could be used to link an individual .....
"

> [PTT] OK, never noticed before. Differs from the convention in another 

I bet it is different. I noticed this aspect with past documents and I 
think we should make the job of the editor easier. Additionally, we 
might want to check the punctuation since this is also a source of a lot 
of editing bugs. I am, however, not the best person todo that.

> small letters in their I-D in this situation.

OK. Let us see what the editor thinks.

Ciao
Hannes