Subject: Re: security text in LINK

From: Phil Karn <[email-masked]>
Date: Thu, 19 Jul 2001 19:38:03 -0700

Okay, in the spirit of compromise, I have ripped out much of the text
in the security section of LINK and replaced it with the following
(with unchanged lines for context). Please comment ASAP; we're coming
down to the wire here.

--Phil

Nonetheless, end-to-end security mechanisms are not used as widely as
might be desired. However, the group could not reach consensus on
whether subnetwork designers should be actively encouraged to
implement mechanisms to protect user data. One point of view holds
that subnetwork security "can't hurt"; though admittedly inferior to
end-to-end security, it is still better than no security at all. This
viewpoint calls for subnetworks to implement mechanisms that achieve a
degree of security commensurate with a series of concatenated
point-to-point links.

Another view holds that subnetwork security mechanisms, especially
when weak or incorrectly implemented [BGW], may actually be
counterproductive.  Such mechanisms can lull end users into a false
sense of security, diminish the incentive to deploy effective
end-to-end mechanisms, and encourage "risky" uses of the Internet that
would not be made if users understood the inherent limits of
subnetwork security mechanisms.

We therefore recommend that subnetwork designers be as candid as
possible with 1) the details of any security mechanisms they implement
to protect user data; and 2) the inherent limits of even the most
secure mechanism when it is implemented in a subnetwork rather than on
an end-to-end basis.

A much stronger case exists for another role for subnetwork security: the
protection of the subnetwork itself in keeping with the "placement

---

From: Joe Touch <[email-masked]>
Date: Thu, 19 Jul 2001 22:52:49 -0700

I caught a few minor items, if useful:

pg 5 - I couldn't find anywhere in IP that requires the link to mark the 
IP start AND end; clearly the start is required, but the rest is marked
by the IP length. Once a single packet is marked, subsequent packet starts
need be marked only if not adjacent. (did I miss something??)

pg 8 - FEC has traditionally ... in a modem. I'd say "NIC" rather; modems
inherently include an analog component. FEC can exist on purely digital
links.

pg 14 - for connections which are short... or long-running connections 
whose data is sporadic (thus experiencing slow-start restart). SSR can
cause long connections to look like a sequence of short ones, w.r.t.
window start, but NOT w.r.t. connection establishment. Lots of things
can cause SSR, too. I wouldn't be surprised if there are link properties
that might trigger it, but I can't think of a quick example... (anyone??)

--

Joe

---

From: Lloyd Wood <[email-masked]>
Date: Fri, 20 Jul 2001 13:08:40 +0100 (BST)

On Thu, 19 Jul 2001, Phil Karn wrote:

> implement mechanisms to protect user data.

I would have thought the market would do _that_.

'Hi! Buy our subnetwork technology! It has no security and does not
 protect user data! This is a feature!'

> One point of view holds that subnetwork security "can't hurt";
> though admittedly inferior to end-to-end security, it is still
> better than no security at all. This viewpoint calls for
> subnetworks to implement mechanisms that achieve a degree of
> security commensurate with a series of concatenated point-to-point
> links.

A series of concatenated p2p links? Owned by whom? That's a very weak
security model, and a very poor, or misleading, analogy.

> subnetwork security mechanisms.

That's a corollary of the necessity for good subnetwork security, not
another view.

> secure mechanism when it is implemented in a subnetwork rather than on

can't argue with that.

L.

<[email-masked]>PGP<http://www.ee.surrey.ac.uk/Personal/L.Wood/>

---

From: "Dr. Carsten Bormann" <[email-masked]>
Date: Fri, 20 Jul 2001 15:16:51 +0200

This reduced text completely loses the point that security must be
commensurate with the security of the link that is being replaced -- i.e.,
for links that go in an intranet, you expect "wired equivalent privacy" (in
the literal sense), while, in the global Internet, you don't really care too
much (with the exception of the protection of the subnetwork, but that is
taken care of by the text that is still in there).

Gruesse, Carsten

PS.: In which way is the following text contentious?
I think it's rather valuable.

    A prime example of new technology invalidating implicit assumptions
    about subnetwork security is the rapid deployment of 802.11 wireless
    LANs [IEEE80211].  802.11 includes a Wire Equivalent Privacy (WEP)
    scheme in which serious flaws were discovered after many wireless
    LANs had been deployed. [BGW]

    Also, the Internet architecture does not allow applications to even
    know the security properties of the subnets along a path. Nor do
    subnetworks have any way to encourage the use of end-to-end security.

    This is consistent with the end-to-end principle. The implementation
    and operation of the Internet and its subnetworks has been greatly
    simplified by leaving to the hosts responsibility for host access
    control, application data confidentiality and integrity.

    However, despite this clear incentive to implement end-to-end
    security, many hosts and applications do not.  Pragmatism therefore
    calls for subnetworks to implement at least a minimal degree of
    security, especially when a shared medium makes it difficult or
    impossible to restrict physical access (e.g., a radio channel).  We
    therefore recommend that, where practical, subnetwork designers
    implement mechanisms to achieve a degree of data privacy and
    integrity comparable to that provided by hardwired point-to-point
    links.  At the same time, users must be made aware that subnetwork
    security, even when it is correctly implemented (unlike 802.11 WEP),
    does not and cannot obviate the need for end-to-end security
    mechanisms.

Maybe "that provided by hardwired point-to-point links." needs to be
replaced by "that provided by links that historically have been used in this
context."

---

From: Joe Touch <[email-masked]>
Date: Fri, 20 Jul 2001 09:32:05 -0700

>     control, application data confidentiality and integrity.

The current text appears to address link security primarily as it
contributes/or not to E2E ...

But there's more than E2E security - 
link security can protect link bandwidth.
No E2E security can do that, per se.

Joe

---

From: Phil Karn <[email-masked]>
Date: Fri, 20 Jul 2001 09:45:21 -0700

>contributes/or not to E2E ...

Yes, that's the topic of that section.

>No E2E security can do that, per se.

That's the topic of the very next section, the one beginning "A much
stronger case exists for another role for subnetwork security: the
protection of the subnetwork itself in keeping with the "placement
principle" ...

Phil

---

From: Joe Touch <[email-masked]>
Date: Fri, 20 Jul 2001 09:52:16 -0700

> protection of the subnetwork itself in keeping with the "placement

AOK - I was getting lost in the mire of the previous section... :-)

Thanks,

Joe

---

From: Dan Grossman <[email-masked]>
Date: Fri, 20 Jul 2001 14:54:42 -0400

> (with unchanged lines for context). Please comment ASAP; we're coming
I accidentally hit "reply to sender" rather than "reply to all" this morning.  
I've given Phil some replacement text that restores some important points, and 
better represents the point of view that I'm trying to capture.  
Unfortunately, I don't have a saved copy to share with the list, and hope Phil 
can forward that text (or better still, integrate it into the draft before the 
deadline).

Dan