Subject: [nfsv4] Comments on CCM draft

From: Sam Hartman <[email-masked]>
Date: Sat, 17 May 2003 14:29:26 -0400

Hi, Mike.  After reading your recent messages on the CCM thread, I
think we are now at a point where we both understand each other's
position and disagree with each other.  My position is unlikely to
change without external input, and I suspect that's true for you as
well.

Let me briefly summarize my position for you again.  I'm not trying to
get into an argument about why I'm wrong; I think I understand why you
believe that and would be happy to summarize that if you believe I
don't understand what you are saying.

Currently, if operated in what I would consider to be a secure mode,
NFS uses GSSRPC.  CCM is not being proposed in order to change the
fundamental security model of NFS but instead to allow us to take
advantage of higher performance crypto hardware.

I believe that CCM must require implementation of channel bindings for
any transport for which it is used.  I wish we were in a situation
where we could require the use of channel bindings, but we are not.

If we require channel bindings, then CCM works within the existing NFS
security model and adds no additional administrative overhead to
securing NFS, while allowing us to take advantage of fast crypto
hardware.  We will need to get cooperation of vendors in order to
expose enough information that we can implement channel bindings.  If
site administrators choose not to use the channel bindings that are
implemented, then they have changed the NFS security model and will
need to think about MITM issues  and other details.

If we do not make channel bindings mandatory to implement, it seems If
channel bindings are not mandatory to implement then we will have
changed the NFS security model in cases where they are not
implemented.  In order to be secure against MITM attacks, people will
need to configure both IPSEC and GSSAPI correctly.  I consider this a
significant additional challenge to the secure deployment of NFS.
When I look at the tradeoff between having more implementations
support CCM vs having all CCM implementations provide a mode of
operation secure against MITM attacks without additional
configuration, I bam clearly on the side of having channel bindings be
mandatory to implement.

Is that consistent with your understanding of my position?

So how do we move along from here?

Well, regardless of the channel bindings issue, I believe that CCM
could use significantly more review from the GSSAPI community and
possibly from the larger security community.  I propose that we seek
that review and as part of the review we ask people to look at the
channel bindings issue.  Clearly input will have to be carefully
considered.  If we get a bunch of security folks who claim that we
protocol should be maximally secure without considering the issues and
tradeoffs that is not very useful.  However if we get people to read
the document, consider the implementation details and come up with an
informed opinion about the channel bindings issues, that should be
useful in determining WG consensus?

Does this seem like a reasonable way to move forward?

_______________________________________________
nfsv4 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nfsv4