Subject: Re: LINK update

From: Phil Karn <[email-masked]>
Date: Thu, 5 Jul 2001 13:17:25 -0700 (PDT)

>-- end users are mostly clueless, and will use secure mechanisms only if the 
>decision to do so is made for them (as when they hit a secure page).  Few take 
>the time or have the skills to figure out how to do things like encrypt email.

I already say pretty much this in the current text.

>-- content providers are often clueless.  Some do nothing, others will take 
>the time and expend the effort to provide security throughout a site;  others 
>will only secure the most sensitive parts of a site (i.e., credit card 

Right. That's what I meant in my point #3.

>I don't think that there are many people who are developing specialized 
>applications around a single subnet, or around the assumption that subnets are 
>somehow "small".

They're all around you! Consider the vast majority of company
intranets.  Look on almost any company intranet and you'll find nearly
all of its traffic is unsecured NFS, SMB, HTTP, SMTP and POP.

>I also think the current text belabors a point.

But your suggested replacement is even longer!

The 7/20 ID deadline is approaching and I've got several other
deadlines to meet, so I don't want to spend a lot of time arguing
about this section. So I'd like to ask the group for guidance; is the
present LINK text on security OK, should it be replaced by Dan's text,
or should the two be merged?

Phil

---

From: Dan Grossman <[email-masked]>
Date: Mon, 09 Jul 2001 13:59:09 -0400

> I already say pretty much this in the current text.
The current text does not capture the subtlety of it, nor does it offer any 
real explanation.  It certainly does not capture the passivity of end users, 
especially consumer end users.
> Right. That's what I meant in my point #3.
But not what you said.  Current text does not differentiate between content 
providers and end users.
> all of its traffic is unsecured NFS, SMB, HTTP, SMTP and POP.
True, I wasn't thinking as much about business intranet as consumer Internet.  
But the point still holds:  most businesses don't do or commission application 
protocol development.  They buy it out of a (shrinkwrap) box.  The stuff comes 
out of the box without any end-to-end security.  End-to-end security, if it 
exists at all, requires significant adminstrative effort to enable, meaning it 
doesn't get enabled.  This has far less to do with size than resource 
expenditure and 'clue'.
> But your suggested replacement is even longer!
There's length for the sake of elucidation and there's length for the sake of 
repetition.
> or should the two be merged?
Hello, group??

---

From: Phil Karn <[email-masked]>
Date: Tue, 10 Jul 2001 22:57:55 -0700

>especially consumer end users.

What's wrong with this short and sweet sentence:

 1. End users may simply be unaware of the risks;

>But not what you said.  Current text does not differentiate between content 

What's an "end user"? If by that you mean somebody browsing the web, I think
I have this covered:

 3. The users may lack the expertise or authority to implement, request
 or configure end-to-end security on both ends of a path (e.g., being
 forced to send clear text passwords to a web site);

I will augment this to clarify that the user may not be able to request that
a remote site encrypt the data he is requesting be sent to him.

>doesn't get enabled.  This has far less to do with size than resource 

Again, this is expressed in point #1 above. But I will augment to make the
point about a lack of admin resources.

Phil

---

From: Dan Grossman <[email-masked]>
Date: Wed, 11 Jul 2001 10:45:51 -0400

> What's an "end user"? If by that you mean somebody browsing the web,
Yes
> I think
But not content providers.

> point about a lack of admin resources.
You're still missing the point.  

Ok, I'd rather you hadn't gone and re-written my earlier text.  But since 
you're insisting on keeping your words, and the rest of the group doesn't seem 
to care,  here are some specific changes that will satisfy the concerns:

-----------------------------------------------------------
   Nonetheless, end-to-end security mechanisms are not used as widely as
   might be desired.  There are several possible reasons:

               ^
               and content providers

   2. Appropriate end-to-end mechanisms may not be readily available for
   the users' specific applications;

   3. End-to-end mechanisms may exist, but require significant
   administrative expertise and resources to enable, configure and
   manage;

   4. The users may lack the authority to implement or configure end-to-
   end security on the far end of a path. E.g., 
replace:
   a user may be forced by
   the lack of encryption support on a web server to send clear text
   passwords, or to accept information requested from the server in
   plaintext;
with
   For example, web sites are often designed to force users to exchange 
   information with the  server in clear text, regardless of their preference 
   for greater privacy.  Such information sometimes even includes passwords. 
end

   5. Performance concerns, e.g., on high-volume web or file servers,
   may limit the use of cryptography to a small fraction of traffic, or
                                          XXXXXXXXXXXXXXXXXXXXXXXXX
                                          only the most sensitive information
   preclude it entirely;

   6. Users may assume (correctly or incorrectly) that adequate security
           ^
           , content providers or adminstrators
   is already provided by the subnetwork(s). This is common when the
   subnetworks are physically small and under direct control by a single
   administrative domain. Many corporate intranets fall into this
   category.
             ^
             Frequently, this assumption is based on an expectation that all 
subnetworks are point-to-point and hard wired.

   There are several problems with relying on subnetwork security.  The
   Internet is specifically designed to provide a uniform, scalable
   network service that is independent of the underlying subnetwork
   technologies, physical topologies and physical location of its
   resources. A subnetwork that starts small (e.g., within a single
   office) may be inherently secure, but small networks have a habit of
   growing.
            ^
            More to the point of this Memo, shared media and wireless subnets 
can easily be added to the Internet without affecting anything above the IP 
layer.
  And as a subnetwork grows, the opportunities for attack
   grow rapidly.

   Also, the Internet architecture does not allow applications to even
   know the security properties of the subnets along a path. Nor do
   subnetworks have any way to encourage the use of end-to-end security.

   This is consistent with the end-to-end principle. The implementation
   and operation of the Internet and its subnetworks has been greatly
   simplified by leaving to the hosts responsibility for host access
   control, application data confidentiality and integrity.

   However, despite this clear incentive to implement end-to-end
   security, many hosts and applications do not.  Pragmatism therefore
   calls for subnetworks to implement at least a minimal degree of
   security, especially when a shared medium makes it difficult or
   impossible to restrict physical access (e.g., a radio channel).  We
   therefore recommend that, where practical, subnetwork designers
   implement mechanisms to achieve a degree of data privacy and
                                               xxxx
   integrity comparable to that provided by hardwired point-to-point
   ^ data
   links.  At the same time, users must be made aware that subnetwork
                             xxxxxxxxxxxxxxxxxxxxxxxxx
                              we emphasize 
   security does not and cannot obviate the need for end-to-end security
   mechanisms.

Dan

---

From: Phil Karn <[email-masked]>
Date: Wed, 11 Jul 2001 20:01:46 -0700

>subnetworks are point-to-point and hard wired.

Is Ethernet a "point-to-point" subnetwork? Not really, despite the
increasing prevalence of switched hubs. Is it "hard wired"?  Again,
not really -- ethernet jacks are everywhere, to make it easier to move
computers around.  Most company intranets use Ethernet quite heavily,
yet their traffic is largely unencrypted.

My point is simple: it doesn't matter whether the subnetwork is
point-to-point or hard wired. That's why I've resisted making
that the reference point for subnetwork security.

The vast majority of corporate intranets have the same, very simple
threat model -- whether or not it was consciously and explicitly
chosen. A perimeter is created that logically divides "inside" from
"outside".  All threats are assumed to come from the outside; insider
threats are ignored, or at least technical means are considered
infeasible in defending against them. In such intranets, *any*
subnetwork technology that one convinces IT management can be
contained inside the security perimeter is considered "secure enough"
to be used without end-to-end security.  The subnetwork technical
details and topology are considered irrelevant.

Hence my language warning about how opportunities for attacking
nominally "closed" networks grow rapidly as these networks grow.
In other words, the basic problem is a simplistic and inadequate
threat model.

Phil

---

From: Dan Grossman <[email-masked]>
Date: Fri, 13 Jul 2001 14:59:06 -0400

> increasing prevalence of switched hubs.
There is little if any shared media Ethernet left. 

> Is it "hard wired"?  Again,
> computers around.
Wires and jacks = hard wired.

>  Most company intranets use Ethernet quite heavily,
We're talking about two different issues: you're focussed on corporate 
intranets and I'm talking about the Internet.  We need to cover both.  I was 
tempted to say that the greater proximate issue is the Internet, but with the 
latest noise about 802.11 hacks, have to reluctantly admit that they're 
equally important.

The point that I'm trying to get the document to emphasize is this:  people 
who ultimately decide NOT to use end-to-end security mechanisms are making the 
assumption that inherent physical protection in the service provider networks 
and (yes) single premises Ethernets is "good enough", and that there's nothing 
else out there.  So for the Internet case, if somebody puts in a wireless home 
network, or is still using certain vendors' very early cable modems, then they 
have NO privacy.  Similarly, if somebody puts an 802.11 base station on a 
corporate Intranet, then there's no privacy (save for the pathetic WEP).

Let's try: 
Frequently, this assumption is based on an expectation that all subnetworks 
are designed so as to require an outside attacker to surreptitiously obtain 
access to a facility which is nominally physically secured.  For example, to 
attack point-to-point fibers or the PSTN, an attacker would probably require 
physical access to a cross connect.  To attack an Ethernet contained entirely 
in a single premises, an attacker would need to obtain access to that 
premises.  The assumption is that such attacks would require sufficient skill 
and determination to render the risk to be slight.

---

From: Phil Karn <[email-masked]>
Date: Mon, 16 Jul 2001 23:19:19 -0700

>latest noise about 802.11 hacks, have to reluctantly admit that they're 

Yes, I'm focused on corporate intranets because that's the only place
I can think of (aside from tiny residential nets) where there is any
concept of "inherent" subnetwork security arising from its small size
and physical control. And as you say, 802.11 is bursting even that assumption.

>The point that I'm trying to get the document to emphasize is this:
>people who ultimately decide NOT to use end-to-end security
>mechanisms are making the assumption that inherent physical
>protection in the service provider networks and (yes) single premises
>Ethernets is "good enough", and that there's nothing else out there.
>So for the Internet case, if somebody puts in a wireless home
>network, or is still using certain vendors' very early cable modems,
>then they have NO privacy.  Similarly, if somebody puts an 802.11
>base station on a corporate Intranet, then there's no privacy (save
>for the pathetic WEP).

Completely agreed.

>subnetworks are designed so as to require an outside attacker to
>surreptitiously obtain access to a facility which is nominally
>physically secured.  For example, to attack point-to-point fibers or
>the PSTN, an attacker would probably require physical access to a
>cross connect.  To attack an Ethernet contained entirely in a single
>premises, an attacker would need to obtain access to that premises.
>The assumption is that such attacks would require sufficient skill

I like this.

Phil