Subject: Re: [Netconf] Unsigned configlets and physical security

From: Randy Presuhn <[email-masked]>
Date: Mon, 3 Mar 2014 11:03:30 -0800 (GMT-08:00)

Hi -

>From: Joe Marcus Clarke <[email-masked]>
>Sent: Mar 3, 2014 9:06 AM
>To: "[email-masked]" <[email-masked]>
>Subject: [Netconf] Unsigned configlets and physical security
...
>Instead, they just need to get a hold of my USB key and insert a 
>malicious configlet.  Then I need to insert it into my otherwise 
>physically secure device, and it will load the [unsigned] malicious 
>bootstrap config.
>
>Kent's argument was that one should check the contents of the configlet 
>before loading (it is clear text after all).  So this may be a 
>non-issue.  However, I wanted to raise it with the WG to see what others 
>think.

If detecting malicious misconfiguration were straightforward,
we'd be able to prevent the inadvertent misconfigurations that
are at the root of so many outages.  Consequently, the "check
the contents" line of reasoning doesn't convince me.

Randy

---

From: Dean Bogdanovic <[email-masked]>
Date: Tue, 4 Mar 2014 17:45:31 +0000

Security comes to policies. Using signed configlets could be left as optional, as some DC operators will be happy to use unsigned configlets, but could also mandate that only pre approved usb keys are used, or any USB key can be used.
Some other operators will state, only signed configlets can be used and they will go through the mapping of USB keys to the devices.

So, voting to make it optional.

Dean

On Mar 3, 2014, at 2:03 PM, Randy Presuhn <[email-masked]> wrote:

> _______________________________________________
> Netconf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/netconf
> 
>

---

From: Kent Watsen <[email-masked]>
Date: Tue, 4 Mar 2014 18:35:18 +0000

>the contents" line of reasoning doesn't convince me.

That sounds more like a competency issue, but I'll grant you that
administrators generating *signed* configlets are likely to be more
thorough than others...

FWIW, The Security thinking is that someone that can get physical access
to a device already owns it.   So, requiring the Configlet to be signed
doesn't protect anything and, given the logistical overhead involved in
getting/using *signed* Configlets, would only frustrate trusted
administrators.  In this case, the administrator is using the Configlet
because it's easier/more-scalable than manual configuration.

Joe brings up the special case where an adversary doesn't get physical
access, but passes an unsigned Configlet to a trusted administrator, who
initializes a device using it without inspecting it first.  To be fair, it
could be that trusted administrator could've been duped and actually
thinks the Configlet is trusted and hence doesn't consider the need to
[re]inspect it.   

Maybe this last issue be addressed via a Security Consideration - e.g.
"unsigned Configlets SHOULD be inspected before each use."  What do you
think?

Thanks,
Kent

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Tue, 4 Mar 2014 19:46:56 +0100

> "unsigned Configlets SHOULD be inspected before each use."  What do you

The person plugging the USB stick into a box may not have much clue
what he is doing, technically. I doubt this can be taken easy - not
all devices are deployed in safe environments by smart people. I am
not sure there always is going to be a 'trusted administrator'.

In fact, during the presentation, I was wondering myself whether the
configlet should not instead be signed _and_ encrypted. The assumption
that someone reads the configlet and is able to decide whether it is a
good one or not seems a bit scary to me, in particular if I think
about boxes deployed in the wild.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>