Subject: Re: [RPSEC] Threats Draft Issue 3: Section 4.5 Underclaiming

From: Jean-Jacques Puig <[email-masked]>
Date: Wed, 6 Aug 2003 16:22:21 +0200

Hi !

	('made a cut and paste from 'Threats Draft Issues: Where we Stand?'
	so that to keep separate threads on specific issues)

On Sun, Jul 13, 2003 at 09:57:39PM -0400, Russ White wrote:
> 
> Did we come to some concensus on whether or not underclaiming is a
> legitimate threat? I know there was a lengthy discussion on this, but I
> don't recall any sort of final concensus around the question.

On Fri, Jul 25, 2003 at 10:40:57PM -0400, Russ White wrote:
> 
> We've had some discussion over some of the issues on the threats draft I
> had recorded from various places; below is a summary of what I have so far.
> We need to get this cleaned up and finished up, so we can move on to
> other
> work in the near future.
>
> ...
> 
> Issue 3: Issue 3: Section 4.5, Is underclaiming a threat to routing
> systems?
> 
> Status: I seem to remember Sandy and some others arguing against
> underclaiming being a threat, while I and others argue for it being a
> threat. The reasoning on one side appears to be that you can't force a
> router to advertise anything (?), while on the other side the claim is that
> this doesn't matter, forcinf information can still cause misrouting to
> occur, and thus it's a threat. It seems we need some closure on this
> one.

After a second reading of the ML mails, WG minutes and drafts on this
topic, current positions are the following (please correct me if I'm
wrong):

For considering underclaiming as a valid attack: Yi, Birger, Russ, Jean-Jacques  (and possibly Tony ?).

Against considering underclaiming as a valid attack: Sandy, Radia,
Curtis (and possibly Stephen ?).

Current input regarding this issue is mainly
draft-beard-rpsec-routing-threats-01, though further elements were
mentioned on the mailing list.

Discussion:

	From RFC 2828: A threat (action ?) can be either "intentional" or
	"accidental".
	According to this, if underclaiming is not a valid attack, it may
	still be an accidental threat action, and as such, can be
	documented in the threats document (according to current approach of
	threats definition sect 3.1).

	There have been input that this attack was against an individual
	network element ? Does anyone want to develop on this ? 
	
	I think the router may not be affected by it's own underclaiming,
	but so is the network it should have advertised; thus a possible
	target of the attack is a network.

	Is it an attack against the routing system ? The routing db is
	affected by underclaiming. If farther on the paths routers make
	*legitimate* underclaiming of the prefix, only a part of the
	routing db may be affected. Most consequences already listed in the
	draft may happen. *Incorrect* distributed routing db is, IMHO, the
	manifestation of that a threat action against routing occured.

	How can a routing protocol be protected against such an attack ? The
	same way such a protocol can check authority for prefix
	advertisement through an appropriate distributed db (e.g.
	http://www.isi.edu/~bmanning/inet98.html ). Such a db may announce
	policies related to routing, and systems REQUIRED (by agreement) to
	advertise a prefix. This may not be sufficient for forcing the path,
	yet it allows detection of an incorrect behavior by non subverted
	devices. Besides, threats are not defined by the existence of a
	solution to them. Sometimes, when robustness cannot be achieved,
	detection can and is of great interest to limit the consequence
	zone. 

	Is it too early for a consensus on this ?

	Comments are welcome !

-- 
Jean-Jacques Puig

[homepage] http://www-lor.int-evry.fr/~puig/

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Stephen Kent <[email-masked]>
Date: Mon, 11 Aug 2003 16:30:42 -0400

Add my vote to the notion that under-claiming ought not be classified 
as an attack.  I think we discussed scenarios in which such action 
might be justifiable, e.g., as a result of contractual issues now 
visible to external parties, and thus this is better left out of the 
list.

Steve

---

From: Tony Tauber <[email-masked]>
Date: Mon, 11 Aug 2003 17:30:25 -0400 (EDT)

On the topic of "underclaiming", the numerical vote is virtually a
tie so let's take out our pragmatic razor.  Even those who think that
there may be some place where such a thing may be classified as a
threat, no one can make any sort of practical sense of what might be
gained from doing so.

Given that, let's remove it from the document to keep from creating
confusion and dilution.  I don't subscribe to some argument for
cryogenically capturing these things for some future generation to
solve. Problems with this approach?

Thanks,

Tony

> > underclaiming being a threat, while I and others argue for it
> > being a threat. The reasoning on one side appears to be that you
> > can't force a router to advertise anything (?), while on the other
> > side the claim is that this doesn't matter, forcinf information
> > can still cause misrouting to occur, and thus it's a threat. It
> > seems we need some closure on this one.
>
> After a second reading of the ML mails, WG minutes and drafts on
> this topic, current positions are the following (please correct me
> if I'm wrong):
>