Subject: Re: [RPSEC] Draft Status, from a protocol developer's angle.

From: "Senthilkumar Ayyasamy" <[email-masked]>
Date: Sat, 27 Jul 2002 06:34:31 -0500

>BTW, the way I see the outcome from this WG as far as the requirements
>(2nd step) are concerned is a document listing a bunch of :
>
>   - MUSTs (things you gotta secure in your protocol),
>   - SHOULDs (things you better have secured, but if you have a very
>     good reason not to, beware of dragons),
>   - MAYs (might be a good idea to look into this)
>   - and probably SHOULD NOTs (things like bootstrap problems)

A quick question!!!
I am often confused with the terms *robustness* and
*security*. The possible causes for lack of robustness is more
than just security breaches. It also includes routing
misconfigurations or many other reasons ( e.g MOAS conflicts
in BGP.) So, Is *robustness of a network* a SHOULD requirement?

As a side note, do you assume the routers to be
functioning correct when defining threats and requirements?

IPSEC or any type of encryption based authendication helps
to prevent attackers from hijacking protocol communication.
But any of the common security mechanisms works on a basic
assumption that every node in a network works functionally
correct. But imagine a situation when some of the routers
are malfunctioning or acting as a DDoS agent.
Does current security mechansims provide an answer in such
scenarios?
perlman's byzantine robustness provides a solution by means
of consensus approach. But i dont know how much the consensus
based algorithms are practical.

- senthil.

But my point is: the threat models SHOULD consider cases of
networks  with malicious routers.

_________________________________________________________________
MSN Photos is the easiest way to share and print your photos: 
http://photos.msn.com/support/worldwide.aspx

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Alex Zinin <[email-masked]>
Date: Sat, 27 Jul 2002 14:50:44 -0700

Senthil,

 I believe that MUSTs and SHOULDs need to be used with very
 quantifiable definitions of the requirements, so that later
 it is possible to tell if that MUST or SHOULD has been
 satisfied.

 The term "robustness" or the adjective "robust" are too generic
 and usually used to characterize protocols and their
 implementations that are able to work well under unusual
 and stress conditions, such as too much state to announce
 or too many messages to process, or neighbors behaving incorrectly,
 or being under an attack. So, I would say that robustness is
 a more generic, collective, and pretty vague characteristic
 that will be hard to formally evaluate.

 The term "Byzantine robustness" is more specific. I think we
 need to look into the area of attacks when some of the trusted
 routers are compromised. There can be a range of solutions
 here that need to be evaluated keeping the engineering trade-offs
 in mind. In some cases attack prevention might be required,
 in others attack detection and elimination may be sufficient.

-- 
Alex