Subject: [Atoca] Requirement for Originator Authentication?

From: Hannes Tschofenig <[email-masked]>
Date: Sat, 15 Jan 2011 21:30:33 +0200

Hi all, 

Igor raised an interesting question during the meeting in context of the security threats, namely: 

" Do we have the requirement to authenticate the originator? "

I couldn't provide him an answer during the meeting because I was not quite sure whether he was asking the question in the style of 

"Do we need end-to-end security or is a hop-by-hop security solution good enough?"

So, I am not quite sure how to interpret the question. 

Ciao
Hannes

---

From: "Thomson, Martin" <[email-masked]>
Date: Mon, 17 Jan 2011 07:32:09 +0800

> " Do we have the requirement to authenticate the originator? "

The question that I heard was not so much related to authentication as it was to authorization.  There was also a question about whether authentication was identity-based or on some other property, like some asserted trait.

What statements can we make about how recipients (and relays) authorize the receipt (and sending) of alert messages?
 
> I couldn't provide him an answer during the meeting because I was not
> quite sure whether he was asking the question in the style of
> 

In the context of this interpretation, I think that there's a real need to delegate alert distribution.  The scale of distribution makes intermediaries a valuable addition.  Relying on the integrity of relays makes the authorization question more difficult to resolve.

For something concrete, the relay case is probably the simplest.  I might trust my signalling peer to a certain extent.  I certainly don't trust them enough to generate the massive packet storm requested by an alert message.  They might say the alert comes from the government, but I might require better proof than their say-so alone.  Distributing an alert will cost me money and I want proof.

That's one argument.  The other argument says that peering relationships require a degree of trust that would not be broken without serious ramifications - enough to discourage its abuse.

The recipient case might have some interesting quirks.  Particularly in wholesale/reseller arrangements.  A recipient that relies on hop-by-hop might receive an alert from the network operator: an entity with whom they have no direct relationship.  For instance, no fewer than two different operators are involved in getting packets to my house, neither of which I have a business relationship with.  How would someone - ignorant of the convoluted business arrangements that underpin their Internet service - decide to authorize an alert that is relayed by either party?

--Martin

---

From: Art Botterell <[email-masked]>
Date: Sun, 16 Jan 2011 19:55:57 -0400

I suspect we'll find that different carriers/gateways will insist on being able to apply their own authorization rules, and thus that end of things will be distributed perforce.  By the same token, I don't foresee a single global identification/credentialling scheme.  The best we can hope for, I suspect, is a reasonable degree of reciprocity among authorities.

The first question, I think, is whether there's a use case for anonymity in authority-to-public alerting; not sure what that would be.

The next question is how far it makes sense to go in specifying the form of an identification scheme.

Thanks!

- Art

On Jan 16, 2011, at 7:32 PM, "Thomson, Martin" <[email-masked]> wrote:

> _______________________________________________
> earlywarning mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/earlywarning