Subject: [RPSEC] Topic 7: Section 4.8 Byzantine Failures

From: [email-masked]
Date: Tue, 11 Mar 2003 17:49:30 -0500 (EST)

Faulty routers were listed as a threat source, and faulty routers
doing faulty actions show up as a threat action (attack).  It would
appear from the definition of Byzantine Failures that all attacks, if
done by a faulty router, are actually Byzantine Failure attacks, not
falsification/overload/etc attacks.  Why?  

Each of the previous attacks descriptions in Section 4 mention that
they could be done by a "compromised router", i.e., by a faulty
router.  So why is there a separate (redundant?)  subsection for those
attacks as done by a faulty router?

"Detecting a Byzantine error is harder than the fail-stop model in the
sense that at least one other processor must do the same computation
to confirm the results."  This sounds like it came from some fault
tolerant textbook.  It doesn't fit the language used elsewhere.
"processor"?  "computation"?  "Fail-stop model"? "confirm the results"?

I don't think this section is necessary.  It appears redundant.

[Also, this section uses the term blackhole as selectively dropping
packets, which is not how it is used in 3.3.]

--Sandy
_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: "Ayyasamy, Senthilkumar (UMKC-Student)" <[email-masked]>
Date: Thu, 13 Mar 2003 06:03:59 -0600

Sandy,

> "processor"?  "computation"?  "Fail-stop model"? "confirm the 

I accept  that this text is out of tune and doesn't fit with
the rest of the draft contents. As for as fail-stop, the term itself 
explains. If there is a failure, the system stops functioning. To be 
precise, we can easily detect that there is some kind of failure. As 
you say, I studied about fail-stop in my distributed systems class.

I am afraid, this is not true with respect to Internet. The Internet
based attacks are random, arbitrary and unpredictable. We are living in 
a world were even a simple implementation bug and misconfiguration lead 
to widespread catastrophe and provide opportunities for backdoors and 
zombies. Please refer to caida's analysis on code-red and slammer.

In short, I don't think Internet failures follow fail-stop model, at least 
seeing recent threats. 

> I don't think this section is necessary.  It appears redundant.

But, we should have a section on byzantine failures(?). As for as 
radia's work on byzantine robustness, its in the solution space which 
is clearly out of scope for the draft. Radia, any comments?
_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: [email-masked]
Date: Fri, 14 Mar 2003 14:21:16 -0500 (EST)

>you say, I studied about fail-stop in my distributed systems class.

I know very well what fail-stop is.  The point is that the term
is not mentioned earlier.  We don't address the problem of fail-stop
errors anywhere, so it makes little sense to try to distinguish this
from a fail-stop error.

>In short, I don't think Internet failures follow fail-stop model, at least 

So the draft need not address them.

--Sandy