Subject: [Model-t] Model-T threat landscape (was: Potential next steps with model-t & meeting)

From: Mark McFadden <[email-masked]>
Date: Tue, 5 Apr 2022 13:32:02 -0500

Hi all:

Thanks for the nudge, ekr.

I did bring together a group back in January to talk about the threat model
that is in RFC3552 and if there should be some next steps in the direction
of reconsidering it.  I'll paste my rough notes into this message. After
that meeting, I also reached out to Martin. I did not come up with a draft
before IETF 113, but I still intend to have something that takes the themes
of the existing security model I-Ds and consolidates them into something
concrete to discuss (see the four steps/tasks at the end of the notes). It
will be good to talk about this during today's call, but here are the notes
from the meeting at the end of January:

//BEGIN attached notes

Dominique, John, Jari, Eliot and I had a 45-minute phone call to talk about
BCP72 and what to propose to Model-T as a path forward. I'm sorry you
couldn't join us, but I did promise to bring you a summary after the call.
I'd be happy to have a short call if you want at a time convenient to you.

I led with a summary of the December 6th call that Jari led and the outcome
of that. Then I said that I hoped we could reach an agreement on some path
forward.

Eliot pointed out that there was no common view about the Internet threat
model and posed questions such as What is an endpoint? Who is talking to
whom? What needs to be authenticated? How do the answers to those questions
affect the threat model? He also said that there were some use cases (such
as IoT) that hadn't been considered. He said that any attempt to revise BCP
72 would be very complex.

Jari said that the situation was now very complex and he felt that not
everyone sees the same picture - perhaps because of their rôle or because
of their interests.

Eliot then said that the threat model was also related to the consolidation
issue.

Jari made the point that this would be a piece of work that was never done.
The threat model is ever-changing. He suggested that rather than make a
comprehensive revision to RFC 3552, another approach would be to do
research and publish work on specific components or use cases. As an
example, he suggested spinning off some of the material in my threat
changes draft.

John agreed that there was an opportunity to have this discussion narrowed
to more specific components and possibly housed in the IRTF rather than the
IAB. He also suggested that it would be useful to do a critical evaluation
of the situation. Being part of the research community could support a
possible task that didn't have a clear endpoint.

Eliot agreed and suggested picking apart components of the work and
spinning up a research group to house them.

Dominique also agreed that breaking it up into components made sense. She
pointed out that RFC 3552 was twenty years old. Something needs to be done.

Jari said that small chunks might be good and agreed that RFC 3552 is out
of date.

I ended up making a suggestion that had rough consensus among the group:

1. RFC 3552 is deserving of an assessment of whether or not it needs
revision.
2. RFC 3552 would be difficult to bis, or replace, as a single document.
3. The IAB could make an architectural statement that the Internet's threat
model is continuously evolving and not static. It's because both the
endpoints and the network that joins them evolves.
4. Breaking up the threat model into components, use cases or other
manageable chunks would be a way to do research on, and make suggestions
for parts of the Internet's threat model.

I said that I would get your input on this and then if we still had some
level of consensus, bring it to the wider Model-T group for further
community input. Jari could informally see if this approach was acceptable
to the IAB. Jari will also be getting the other group on principles
together in the next week or so.
//END attached notes

mark

-- 
Mark McFadden
CTO
internet policy advisors, llc
+1 608 504 7776 <+1%20608%20504%207776> | +44 2921 25 3640
<+44%202921%2025%203640>
[email-masked]