Subject: Re: Certificate Policy Standardization

From: [email-masked] (Peter Gutmann)
Date: Thu, 27 Nov 2003 07:14:10 +1300

Stephen Kent <[email-masked]> writes:

>Implementors of a technology ought (MUST/SHALL?) be competent in the
>technology that they are implementing. A standard like IPsec is not a "Secure
>Communication  Protocols for Dummies" document.

  The first thing one notices when looking at IPsec is that the documentation
  is very hard to understand. There is no overview or introduction, the reader
  has to assemble all the pieces and build an overview himself. This is a
  highly unsatisfactorily state of affairs; after all, the documentation is
  meant to convey information to the readers. We do not believe it is
  reasonable to expect anyone to learn IPsec from the IPsec documentation.
  Various parts of the IPsec documentation are very hard to read. For ex-
  ample, the ISAKMP specifications [MSST98] contain numerous errors, essential
  explanations are missing, and the document contradicts itself in various
  places.

  [...]
  
  None of the IPsec documentation provides any rationale for any of the
  choices that were made. Although this is somewhat less important than a
  clear statement of the goals, we nevertheless consider it crucial
  information. If a reviewer is to comment on the design (and RFCs are, after
  all, Requests For Comments), he should be told what each option was intended
  to achieve. Without any rationale, the reviewer is left to guess at it, and
  then review the design based on the guessed-at rationale.

  [...]
  
  In our opinion, IPsec is too complex to be secure. The design obviously
  tries to support many different situations with different options. We feel
  very strongly that the resulting system is well beyond the level of
  complexity that can be analysed or properly implemented with current method-
  ologies. Thus, no IPsec system will achieve the goal of providing a high
  level of security.

  [...]

  It is far too complex, and the complexity has lead to a large number of
  ambiguities, contradictions, inefficiencies, and weaknesses. It has been
  very hard work to perform any kind of security analysis; we do not feel that
  we fully understand the system, let alone have fully analyzed it.

Obviously non-dummies can't make much sense of it either.

Peter.

---

From: Stephen Kent <[email-masked]>
Date: Wed, 26 Nov 2003 13:35:42 -0500

Peter,

Citing the critique from the Counterpane analysis of Ipsec and IKE 
from 5 years ago is a nice touch, but you should be aware that the 
non-IKE criticisms were largely refuted in messages on the IPsec 
list. Or, were you aware of that and did you simply choose to not 
share that part of the history with this list?

Unfortunately, the folks who performed the analysis were not protocol 
experts. They made assertions of what was wrong and how it should be 
fixed, and in most instances THEY were wrong. So, in this case, what 
we had were crypto experts offering protocol criticisms that they 
were not qualified to make. I hesitate to use the term "dummies" 
here, but its not all that far off, relative to the expertise that 
one should possess to be a good implementor.  In fact we had a repeat 
of this sort of argument in the last 12 months, when a capable 
cryptographer argued about how to use counter mode in IPsec, but 
without benefit of a deep understanding of assurance issues, FIPS 140 
evaluation, etc. Here too the non-dummy was just wrong in this 
context.

Sorry to spoil you rejoinder, but the facts don't support your 
position, and the cited text is just an example of smart folks who 
are not experts in the area in question getting it wrong.

Steve