Subject: [OPSEC] New I-D: Security Assessment of the Internet Protocol

From: Fernando Gont <[email-masked]>
Date: Mon, 25 Aug 2008 04:55:43 -0300

Folks,

I have submitted a new Internet-Draft, entitled "Security Assessment 
of the Internet Protocol version 4", aimed at the OPSEC WG. The I-D 
is available at: 
http://www.ietf.org/internet-drafts/draft-gont-opsec-ip-security-00.txt 
. Additionally, the same draft is available in other fancy formats 
(HTML and PDF) at: http://www.gont.com.ar/drafts/ip-security/index.html .

The abstract of the document is:
---- cut here ----
    This document contains a security assessment of the IETF
    specifications of the Internet Protocol version 4, and of a number of
    mechanisms and policies in use by popular IPv4 implementations.  It
    is based on the results of a project carried out by the UK's Centre
    for the Protection of National Infrastructure (CPNI).
---- cut here ----

This I-D is simply and IETF-I-D- formatted version of the document 
that was recently released by the UK's Centre for the Protection of 
National Infrastructure (CPNI), available at: 
http://www.cpni.gov.uk/Docs/InternetProtocol.pdf . That is, this I-D 
is our effort to bring the results of the UK's CPNI project to the IETF.

FWIW, the "Preface" of the UK CPNI document describes the motivation 
of this project:
---- cut here ----
The TCP/IP protocols were conceived during a time that was quite different
from the hostile environment they operate in now. Yet a direct result of
their effectiveness and widespread early adoption is that much of today's
global economy remains dependent upon them.

While many textbooks and articles have created the myth that the Internet
Protocols (IP) were designed for warfare environments, the top level goal
for the DARPA Internet Program was the sharing of large service machines on
the ARPANET. As a result, many protocol specifications focus only on the
operational aspects of the protocols they specify and overlook their
security implications.

Though Internet technology has evolved, the building blocks are basically
the same core protocols adopted by the ARPANET more than two decades ago.
During the last twenty years many vulnerabilities have been identified in
the TCP/IP stacks of a number of systems. Some were flaws in protocol
implementations which affect only a reduced number of systems. Others were
flaws in the protocols themselves affecting virtually every existing
implementation. Even in the last couple of years researchers were still
working on security problems in the core protocols.

The discovery of vulnerabilities in the TCP/IP protocols led to reports
being published by a number of CSIRTs (Computer Security Incident Response
Teams) and vendors, which helped to raise awareness about the threats as
well as the best mitigations known at the time the reports were published.

Much of the effort of the security community on the Internet protocols did
not result in official documents (RFCs) being issued by the IETF (Internet
Engineering Task Force) leading to a situation in which "known"
security problems have not always been addressed by all vendors. In many
cases vendors have implemented quick "fixes" to protocol flaws without
a careful analysis of their effectiveness and their impact on
interoperability.

As a result, any system built in the future according to the official
TCP/IP specifications might reincarnate security flaws that have already
hit our communication systems in the past.

Producing a secure TCP/IP implementation nowadays is a very difficult task
partly because of no single document that can serve as a security roadmap
for the protocols.

There is clearly a need for a companion document to the IETF specifications
that discusses the security aspects and implications of the protocols,
identifies the possible threats, proposes possible counter-measures, and
analyses their respective effectiveness.

This document is the result of an assessment of the IETF specifications of
the Internet Protocol from a security point of view. Possible threats were
identified and, where possible, counter-measures were proposed.
Additionally, many implementation flaws that have led to security
vulnerabilities have been referenced in the hope that future
implementations will not incur the same problems. This document does not
limit itself to performing a security assessment of the relevant IETF
specification but also offers an assessment of common implementation
strategies.

Whilst not aiming to be the final word on the security of the IP, this
document aims to raise awareness about the many security threats based on
the IP protocol that have been faced in the past, those that we are
currently facing, and those we may still have to deal with in the future.
It provides advice for the secure implementation of the IP, and also
insights about the security aspects of the IP that may be of help to the
Internet operations community.

Feedback from the community is more than encouraged to help this document
be as accurate as possible and to keep it updated as new threats are
discovered.
---- cut here ----

Any feedback will be more than welcome.

Thanks!

Kind regards,

--
Fernando Gont
e-mail: [email-masked] || [email-masked]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

_______________________________________________
OPSEC mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/opsec

---

From: George M Jones <[email-masked]>
Date: Mon, 25 Aug 2008 06:57:12 -0400

A couple thoughts/reactions:

 - A lot of the info about the protocols, headers, etc,. seems 
elementary (at least for this audience).
 - I can't believe that in the history of the Internet nothing like this 
has every been done ?
 - The references list looks useful.
 - Question: were you involved in the writing of the CPNI paper ?

Thanks,
---George Jones

---

From: Fernando Gont <[email-masked]>
Date: Mon, 25 Aug 2008 08:03:02 -0300

>elementary (at least for this audience).

You mean the introduction, and protocol description, or what?

>- I can't believe that in the history of the Internet nothing like 
>this has every been done ?

Not that I am aware of. Nothing showed up in Google, either. And, 
after a few weeks of having posted the paper to bugtraq and 
full-disclosure, nobody pointed to such thing-

>- The references list looks useful.

The "References" section has required a *lot* of work. Id did my 
homework, and read all of them (plus many others that I thought were 
not relevant or worth including).

>- Question: were you involved in the writing of the CPNI paper ?

Yes: I wrote the paper myself.

Thanks!

Kind regards,

---

From: Roland Dobbins <[email-masked]>
Date: Mon, 25 Aug 2008 18:12:10 +0700

> this has every been done ?

Not to my knowledge - something of this sort has been sorely needed  
for quite some time, IMHO.

-----------------------------------------------------------------------
Roland Dobbins <[email-masked]> // +66.83.266.6344 mobile

      History is a great teacher, but it also lies with impunity.

                    -- John Robb