Subject: Re: [Uta] Threat model

From: Peter Gutmann <[email-masked]>
Date: Thu, 9 Oct 2014 02:03:07 +0000

Ralph Holz <[email-masked]> writes:

>As an addendum to my last mail, I would like to add that TLS itself does not
>have a threat model.

Very few crypto/security standards do.  DNSSEC has one, but that was tacked on
well after the RFCs were written.

The other way of looking at it is that crypto/security standards all (well,
almost all) have the same threat model, which I refer to in my book as the
Inside-Out Threat Model: Whatever this standard happens to defend against is
defined to be the threat.

Peter.

---

From: t.p. <[email-masked]>
Date: Thu, 9 Oct 2014 09:26:57 +0100

----- Original Message -----
From: "Peter Gutmann" <[email-masked]>
To: <[email-masked]>
Sent: Thursday, October 09, 2014 3:03 AM
> defined to be the threat.

or look at security standards as being the defense against some threat.
I have been involved several times in adding security to an existing
application protocol and the Security AD has started by asking what
threats the application wishes to defend against.  After which it is
possible to evaluate TLS, e.g., as suitable - or not.  So here it should
be a question of what threats face IMAP, SMTP, HTTP and so on and, at
least in the case of the last, it then depends on what is happening
about HTTP, buying a theatre ticket with a credit card v transferring
the funds to buy a house.

Tom Petch

>
> Peter.
> _______________________________________________
> Uta mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/uta
>

---

From: Ralph Holz <[email-masked]>
Date: Thu, 09 Oct 2014 11:23:19 +0200

Hi,

> defined to be the threat.

In this case, I'd rather go for a Dolev-Yao minus delay and delete-kind
of thing... no need to enumerate everything the attacker can do.

BTW, almost all protocols lack a definition of what they mean by
"authentication", too. Cas Cremers showed that IPSec authentication is
broken for a number of definitions, although fortunately not for "the
intuitive one" and the one it was probably designed for. I suspect the
same holds for SSL.

Ralph

-- 
Ralph Holz
I8 - Network Architectures and Services
Technische Universität München
http://www.net.in.tum.de/de/mitarbeiter/holz/
Phone +49.89.289.18010
PGP: A805 D19C E23E 6BBB E0C4  86DC 520E 0C83 69B0 03EF