Subject: Re: [weirds] Security Requirements: Authorization

From: Edward Lewis <[email-masked]>
Date: Thu, 1 Nov 2012 10:18:54 -0400

What I didn't see in the thread was any requirements that the 
protocol allow the client to determine if the origin of the response 
was authorized to provide the data.

Use case - ithe server for .malicious is not authorized to originate 
information about neither the IETF.ORG registration nor the 
133.0.0.0/8 IPv4 address range.

Ways to combat this is to declare an authorization model for the 
protocol and to  require any data integrity protection to identify 
the source of the protection, like the signature.

 From DNSSEC (my favorite reference), RFC 3008 (yes, it's obsolete but 
the history of it is germain) confined the signer field in the RRSIG 
to be the name of the management zone responsible for the data. 
Prior to that we had an open authorization model but found it to be 
unmanageable.  And inside the RRSIG there is a pair of fields that 
identify the key used to generate/verify the signature which provides 
a like of the data integrity to the source.  From that the verifier 
can judge whether the data originated with the correct authority.

Note - originating and redistributing data are two different things. 
In DNS we have caches that respond with data for which they are not 
authorized to originate.  The "problem" though is not restricted to 
caches in DNS, I've seen a number of organizations scrape or grab 
copies of authorized data and then redistribute the data.

To "combat" the latter, or at least limit any damage that might 
result, defense against replay is needed, which is usually tied to a 
(signed) wall clock reading.
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis
NeuStar                    You can leave a voice message at +1-571-434-5468

2012...time to reuse those 1984 calendars!

---

From: "John Levine" <[email-masked]>
Date: 2 Nov 2012 00:21:45 -0000

>the source of the protection, like the signature.

This is isomorphic to the bootstrapping problem.  A highly effective
way to avoid getting bad information from the wrong server is to know
which is the right server or servers for each question, and ask only
those servers.

Since I think we all agree that we need to solve the boostrap problem,
how about if we just do that and not invent something else that will
only benefit people get their bootstrap wrong?

R's,
John