Subject: [Cfrg] proposal for informational RFC

From: "Catherine A. Meadows" <[email-masked]>
Date: Thu, 8 Aug 2002 12:26:20 -0400 (EDT)

Hi everybody:

I've been working with the IETF for a number of years, performing
mechanized security analyses of various IETF protocols, including
IKE and GDOI, and am presently engaged in an analysis of IKEv2.
A while back, when I was starting work on the GDOI protocol, I gave
an informal talk to the SMuG working group on what a security analyst
would like to see in an Internet Draft, that is what information
should be included to make a meaningful security analysis possible.
This was mainly intended to describe the type of information I need
to perform the sort of mechanized protocol analysis that I and
other formal methods people do, in which we assume that the
basic cryptographic mechanisms behave as black boxes and look
for higher-level attacks, but the requirements are general enough
so that I think that they would apply to any kind of security
analysis, including a cryptographic one.

I've had some interest from various WGs in seeing the slides from this
talk, and I've been passing them around on an informal basis.  But
I've been intending to write this up in a more permament form, possibly
as an informational RFC.  It has occurred to me that cfrg might be the
most appropriate forum for this, especially since it would allow
me to get feedback from others who have done security analyses of IETF
protocols.

Anyway, let me know what you think.
Would you be interested in seeing something like this?  Does cfrg look
like an appropriate forum?

Cathy

_______________________________________________
Cfrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/cfrg

---

From: Uri Blumenthal <[email-masked]>
Date: Thu, 08 Aug 2002 15:15:39 -0400

> ............. I gave
> should be included to make a meaningful security analysis possible......
> talk... But I've been intending to write this up in a more permament form
> ...It has occurred to me that cfrg might be the most appropriate forum
> for this..................
>
> Would you be interested in seeing something like this? 
> Does cfrg look like an appropriate forum?

In short. Yes and yes.

Thank you!

---

From: "David A. Mcgrew" <[email-masked]>
Date: Thu, 8 Aug 2002 12:41:15 -0700

Cathy,

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of
> Catherine A. Meadows
> Sent: Thursday, August 08, 2002 9:26 AM
> To: [email-masked]
> Cc: [email-masked]
> Subject: [Cfrg] proposal for informational RFC
>
>
> Hi everybody:
>

Yes, I remember the talk.  And for those who don't know, Cathy's mechanized
analysis made a real contribution to the security of GDOI, catching a subtle
flaw that was subsequently fixed.

> me to get feedback from others who have done security analyses of IETF

That sounds great.

> like an appropriate forum?

I think that the RFC that you describe would be a great contribution for
CFRG.

David