Subject: LINK update

From: Phil Karn <[email-masked]>
Date: Sat, 23 Jun 2001 15:07:48 -0700

I have again updated the LINK draft on my website

http://people.qualcomm.com/karn/pilc.txt

to reflect recent comments and additions by Dan Grossman and Lloyd
Wood, among others. Please review and comment; this document is
getting asymptotically closer to being done.

Thanks,

Phil

---

From: Dan Grossman <[email-masked]>
Date: Mon, 25 Jun 2001 14:43:43 -0400

I don't want to be nitpicking, but the paragraphs about why end-to-end 
security is not as widely used as it should be still incorrectly capture the 
issue:

----- Current text -----------
 Nonetheless, end-to-end security mechanisms are not used as widely as
   might be desired.  There are several possible reasons:

   1. End users may simply be unaware of the risks;

   2. Appropriate end-to-end mechanisms may not be readily available for
   the users' specific applications;

   3. The users may lack the expertise or authority to implement or
   configure end-to-end security on both ends of a path (e.g., being
   forced to send clear text passwords to a web site);

   4. They may assume (correctly or incorrectly) that adequate security
   is already provided by the subnetwork(s). This is common when the
   subnetworks are physically small and under direct control by a single
   administrative domain.

   There are several problems with this last assumption.  The Internet
   is specifically designed to provide a uniform, scalable network
   service that is independent of the underlying subnetwork
   technologies, physical topologies and physical location of its
   resources. A subnetwork that starts small (e.g., within a single
   office) may be inherently secure, but small networks have a habit of
   growing.  And as a subnetwork grows, the opportunities for attack
   grow rapidly.

   Also, the Internet architecture does not allow applications to even
   know the security properties of the subnets along a path. Nor do
   subnetworks have any way to encourage the use of end-to-end security.

   This is consistent with the end-to-end principle. The implementation
   and operation of the Internet and its subnetworks has been greatly
   simplified by leaving to the hosts responsibility for host access
   control, application data confidentiality and integrity.
------- end current text ------------
I don't believe this captures the failure of the Internet 'ecosystem' to use 
the tools available.  The way I understand it:
-- end users are mostly clueless, and will use secure mechanisms only if the 
decision to do so is made for them (as when they hit a secure page).  Few take 
the time or have the skills to figure out how to do things like encrypt email.

-- content providers are often clueless.  Some do nothing, others will take 
the time and expend the effort to provide security throughout a site;  others 
will only secure the most sensitive parts of a site (i.e., credit card 
transactions).  Other content which might be privacy sensitive can go 
unprotected.  For example, as an exercise for the reader: sex, health and 
personal finance are three things that most people consider to be extremely 
private matters.  Now, hit your favorite Internet book seller and search for 
books on your choice of "erotica & (well, whatever!)" or "living with herpes" 
or "personal bankruptcy".  Choose the category that you would find most 
private.  Pick a book and order it.   Note whether the search and the process 
of adding a book to the shopping cart is secure.  Then ask yourself whether 
you'd want your next-door neighbors to have eavesdropped on that transaction. 

 There are performance penalties associated with security mechanisms, which 
content providers need to take into account, and these have real costs in 
hardware or end user satisfaction.    

It's pretty easy to assume that **most** users are getting Internet access 
over dialup (which is fairly hard to tap), and pretty easy to ignore a variety 
of attacks on routers. To say nothing of assuming away WLANs.  And the few 
folks who are fortunate to have cable modems get baseline privacy, and DSL is 
even more impractical to tap than dialup.  

-- software developers often do not provide end-to-end security, based on the 
perception that there's no business case for providing it, because it's damn 
hard to do, and perhaps for fear of liability if it's done wrong.  What they 
do provide is pretty hard to configure and all too often has vulnerabilities.

-- the IETF makes many security standards, some of which are duplicative and 
all of which are difficult to understand.  We have no more than moral 
authority to encourage their use.  The IESG has all it can do to keep our own 
house in order, much less knocking on the doors of thousands of dotcoms to 
remind them of good security architecture.

I don't think that there are many people who are developing specialized 
applications around a single subnet, or around the assumption that subnets are 
somehow "small".

I also think the current text belabors a point.

So, let's try the following:
----------------------------------------------
Nonetheless, end-to-end security mechanisms are not used over the Internet as 
widely as
might be desired.  Most usage of the Internet presently involves an end-user's 
client, and a content provider's server.  To the extent that end users have 
any opportunity to influence security decisions (as they might with email), 
they often are simply unaware of risks, or lack the skills to configure 
security mechanisms.   More often, security decisions are made by content 
providers.  Some of these do employ sound security policies and strong 
mechanisms.  However, many ignore security issues altogether, or secure only 
the most sensitive portions of their content (e.g., those involving credit 
card numbers) and leave less sensitive portions of the content (e.g., 
browsing) unsecured.  The failure of content providers to provide strong 
end-to-end security for all content may be attributed to any number of 
factors, including lack of understanding or skill, complexity of security 
software, and server performance issues.  In addition, some are concerned only 
for protection of financial transaction information (such as credit card 
numbers) to the exclusion of other concerns (such as the users' personal 
privacy).  

Often, the belief that the security afforded by the Internet without any 
end-to-end security mechanisms is "good enough" is rationalized by an 
assumption that almost all paths in the Internet are over a concatenation of 
inherently relatively secure (i.e., point-to-point) subnetworks.  While this 
assumption presently holds for most paths, it cannot be assumed to hold in 
general or in the future.  There are subnets that have inherent 
vulnerabilities, including many of those contemplated by this memo.  The 
Internet architecture does not allow applications to  know the security 
properties of the subnets along a path. Nor do subnetworks have any way to 
encourage the use of end-to-end security.  This too is consistent with the 
end-to-end principle. 

Unfortunately, the IETF cannot enforce good security practice or adherence to 
architectural principles.  We therefore recommend that, where practical, 
subnetwork designers implement mechanisms to achieve a degree of data privacy 
and integrity comparable to that provided by hardwired point-to-point links. 
At the same time, it must be strongly emphasized that subnetwork security does 
not and cannot obviate the need for end-to-end security mechanisms.