Subject: RE: Port numbers and IPv6(was: I-D ACTION:draft-klensin-iana-reg-policy-00.txt)

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 19 Jul 2005 14:35:41 -0700

> Host and application security are not the job of the network. 

They are the job of the network interfaces. The gateway between a
network and the internetwork should be closely controlled and guarded.

Nobody is really proposing embedding security into the Internet backbone
(at least not yet). But the backbone has always had controls enforced
such as ingress and egress filtering. Most people think that carriers
should not be allowing people to inject bogons.

Modern security architectures do not rely exclusively on application
security. If you want to connect up to a state of the art corporate
network the machine has to authenticate. In the future every hub, every
router, every NIC will be performing policy enforcement. 

De-perimeterization is not really about removing the firewalls, it is
really about making every part of the *network* into a security control
point. 

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Wed, 20 Jul 2005 00:36:24 +0200

> network and the internetwork should be closely controlled and guarded.

You may want to read up on the end-to-end principle (or argument, if  
you prefer). It's not the "network interface-to-network interface"  
principle.

In other words: if the endpoints in the communication already do  
something, duplicating that same function in the middle as well is  
superfluous and usually harmful.

> (at least not yet).

Good thing too, as "security" is one of those words that really  
doesn't mean anything when you drill down.

> But the backbone has always had controls enforced such as ingress  
> and egress filtering. Most people think that carriers should not be  
> allowing people to inject bogons.

As long as our network doesn't provide any mechanisms for receivers  
to reject unwanted incoming traffic filtering out packets with  
falsified source addresses can be slightly helpful, yes. But that's  
lightyears away from making filtering in the middle of the network an  
architecturally sound approach.

> router, every NIC will be performing policy enforcement.

And it still won't stop people from showing up at IETF meetings and  
transmitting their passwords in the clear over an open radio network.  
This is a road that leads nowhere: you can't tell with from a packet  
whether it's part of something evil or not.

Unfortunately we don't really have anything better right now. Sure,  
IPsec is great, but try replacing every instance of SSL (which is  
very vulnerable to denial of service, and not just the packet  
flooding type) with IPsec and you'll soon see that IPsec is way too  
hard to deploy as a general purpose end-to-end protection mechanism.  
(And for fundamental reasons, not just because the implementations  
aren't userfriendly enough.)

Whatever happened to speak softly, but carry a big stick? On the  
network, everyone shouts, but real consequences are far and few between.

---

From: Stephen Kent <[email-masked]>
Date: Tue, 19 Jul 2005 21:57:00 -0400

At 2:35 PM -0700 7/19/05, Hallam-Baker, Phillip wrote:
>such as ingress and egress filtering.

no, it does not, although many folks might like to believe this is 
true. relying on every ISP to perform such filtering also would be a 
blatant violation of the principle of least privilege anyway.

>  Most people think that carriers
>network the machine has to authenticate.

the notion that one has to "log into the net" is a quaint one, 
perhaps inspired by Windows and the registry. as a mac user, I can't 
relate to this notion, nor can most Unix users, I bet.

>In the future every hub, every

if folks rely on such distributed enforcement, they will get what they deserve.

why not just propose rigorous enforcement of setting the evil bit by 
all network attachment devices, etc?

>really about making every part of the *network* into a security control

Firewalls were created, in part, because site admins realized that 
they were unable to perform configuration management for the many 
devices on their nets. a firewall was a device owned by the admin and 
under his control, and if it acted as a gatekeeper for the net, then 
his job was easier. the fact that it is am imperfect gatekeeper is a 
second order issue.

Steve

---

From: "Tom Petch" <[email-masked]>
Date: Wed, 20 Jul 2005 21:41:13 +0200

<inline>
Tom Petch

----- Original Message -----
From: "Iljitsch van Beijnum" <[email-masked]>
To: "Hallam-Baker, Phillip" <[email-masked]>
Cc: "IETF General Discussion Mailing List" <[email-masked]>
Sent: Wednesday, July 20, 2005 12:36 AM
Subject: Re: Port numbers andIPv6(was: I-D
ACTION:draft-klensin-iana-reg-policy-00.txt)

> superfluous and usually harmful.

Mmmm so if I am doing error correction in the end hosts, and somewhere along the
way is a highly error prone satellite lnk, then I should let the hosts correct
all the satellite-created errors?  I don't think that that is the way it is
done.

Likewise, if my sensitive data mostly traverses hard to penetrate links (fibre)
but just somewhere uses a vulnerable one (wireless), then I just use application
level encryption, as opposed to adding link encryption over the wireless link in
addition?  Again, I think not.

End-to-end is not always best but I am not sure which law of network engineering
points out the exceptions.  Probably something to do with different levels of
entropy along the way.

<snip>

---

From: David Hopwood <[email-masked]>
Date: Wed, 20 Jul 2005 22:21:39 +0100

Tom Petch wrote:
> From: "Iljitsch van Beijnum" <[email-masked]>:
>
> points out the exceptions.

Saltzer, Reed and Clark's paper "End-to-end Arguments in System Design" points
out the exceptions:
<http://mit.edu/Saltzer/www/publications/endtoend/endtoend.pdf>
(starting at the heading "Performance aspects").

-- 
David Hopwood <[email-masked]>

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 22 Jul 2005 01:44:51 +0200

> all the satellite-created errors?  I don't think that that is the way it is

That isn't quite the point.

The end systems can't assume error correction en route; if they require
correct data, they must apply e2e error correction of some kind. Certainly
a TCP retransmission is not optimal if there happens to be a satellite
hop - so nobody objects to satellite hops performing aggressive FEC.
But this doesn't let the end systems off the hook.

> addition?  Again, I think not.

Again, the end systems cannot safely assume anything. If the hypothetical encrypted
wireless link goes down, and is backed up by a piece of telelphone wire, e2e
protection is the only answer.

> points out the exceptions.  Probably something to do with different levels of

We are after good enough, not best. I think that the point of the Saltzer et al
paper is that e2e is always good enough.

I have to agree that e2e cannot create network level QoS that isn't available -
if the best path available can't offer the desired QoS, no end system magic can
achieve that QoS. But it can at least make the best use of the QoS available,
e.g. by reducing a streaming data rate to avoid random loss.

In answer to another comment, it's perfectly true that some services today are
provided by systems intermediate between the end users concerned; these are sometimes
referred to as services in the network. But that really doesn't change the point
of Saltzer et al. The boxes providing those services are end systems as far as
Level 3 is concerned.

    Brian

---

From: Masataka Ohta <[email-masked]>
Date: Fri, 22 Jul 2005 19:31:22 +0900

> e.g. by reducing a streaming data rate to avoid random loss.

The problem is that the meaning of "end" varies. For example,
with mobility, a home agent is an end and with multicast, some
entity which manages a group is an end (which is why dense
mode multicast with no such entity does not scale).

As for QoS, it can be said that all the intermediate routers are
ends.

In a sense, systems on a path between a source and a destination
may be ends, as long as the path is determined dynamically and
the systems hold dynamic state only, because the systems have
proper knowledge on the ongoing communication.

In a sense, "end" means a system with proper knowledge and control
on the ongoing communication.

For example, as for QoS, PDP, which definitely is not "end" with
limited knowledge and control, destroyed E2E property.

						Masataka Ohta