Subject: [anonsec] request for posts on separate WG vs. merged

From: touch at ISI.EDU (Joe Touch)
Date: Wed Dec 1 08:22:20 2004

[email-masked] wrote:
>   My opinion is that it isn't enough to get better-than-nothing
> security. One has to also let the application know that it got that.

<hat off>

Does an application know whether you've chosen a certificate signed by a 
crummy CA? Or when you use a shared key that's been compromised or is 
easy to guess?

I agree that passing 'strength' information back up to the layers is 
useful, as is being able to let the upper layers pass info back down 
that their layer has done extra work that increases the strength of the 
association, as well as 'binding' the two together.

I don't see how any of that is unique to BTNS, though. Insofar as some 
of that work has already been done, as I've said before, BTNS should 
comply with and not defeat these capabilities. However, I don't see that 
BTNS is a good place to further develop those ideas, unless their 
developed in ways that are needed to support BTNS use. On that last 
point, I haven't seen anyone make a case that BTNS needs such unique 
extensions.

Joe
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 254 bytes
Desc: OpenPGP digital signature
Url : http://www.postel.org/pipermail/anonsec/attachments/20041201/3dd7508f/signature.bin

---

From: mcr at sandelman.ottawa.on.ca (Michael Richardson)
Date: Sun Dec 26 08:27:02 2004

>>>>> "Joe" == Joe Touch <[email-masked]> writes:
    Joe> Does an application know whether you've chosen a certificate signed
    Joe> by a crummy CA? Or when you use a shared key that's been compromised
    Joe> or is easy to guess?

  yes.

  Right now applications that want security and can not get it from a
common security layer, use TLS.

  Aside from HTTPS, if you look at actual usage of TLS, in for instance,
SMTP (where we have actual anonymous encryption working very frequently
according to my logs), one thing that applications commonly due is make
relay/do-not-relay decisions when they see that the peer is "trusted"

    Joe> I don't see how any of that is unique to BTNS, though. Insofar as
    Joe> some of that work has already been done, as I've said before, BTNS
    Joe> should comply with and not defeat these capabilities. However, I
    Joe> don't see that BTNS is a good place to further develop those ideas,
    Joe> unless their developed in ways that are needed to support BTNS
    Joe> use. On that last point, I haven't seen anyone make a case that BTNS
    Joe> needs such unique extensions.

  It is my belief that without such an extension, that BTNS has no value
other than for BGP.

-- 
]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson,    Xelerance Corporation, Ottawa, ON    |net architect[
] [email-masked]      http://www.sandelman.ottawa.on.ca/mcr/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 306 bytes
Desc: not available
Url : http://www.postel.org/pipermail/anonsec/attachments/20041226/5dbd7c53/attachment.bin

---

From: paul.hoffman at vpnc.org (Paul Hoffman / VPNC)
Date: Tue Dec 28 21:49:04 2004

>   It is my belief that without such an extension, that BTNS has no value

There is an important difference between "no value to me" and "no 
value to anyone else". If you are claiming the latter, that's an 
awfully big jump.

Off the top of my head, I can think of another: DNS. In the absence 
of DNSSEC, I still want to know that the answers I am getting from my 
ISP are what they sent, and I don't want anyone knowing that I asked.

--Paul Hoffman, Director
--VPN Consortium

---

From: mcr at sandelman.ottawa.on.ca (Michael Richardson)
Date: Fri Dec 31 15:51:36 2004

-----BEGIN PGP SIGNED MESSAGE-----

    mcr> It is my belief that without such an extension (for channel
    mcr> bindings), that BTNS has no value other than for BGP.

>>>>> "Paul" == VPNC  <Paul> writes:
    Paul> There is an important difference between "no value to me" and "no
    Paul> value to anyone else". If you are claiming the latter, that's an
    Paul> awfully big jump.

  I think that it will have sufficiently low value that it will not be
available in common desktop operating systems.

    Paul> Off the top of my head, I can think of another: DNS. In the absence
    Paul> of DNSSEC, I still want to know that the answers I am getting from
    Paul> my ISP are what they sent, and I don't want anyone knowing that I
    Paul> asked.

  DNSSEC would never make the questions/answers private, which I think is
valuable. I am not really sure that you could infer anything else about the
answers.

  It certainly would keep mis-BEHAVE-ing systems off of your packets, though,
but only if you do leap-of-faith-save-to-disk. (Because the nefarious boxes
could just participate in the exchange...)

  My question: would you wish to *AVOID* making certain queries if you knew
that DNS wasn't over BTNS?  If so, then you need to make the ability to
notify the applications about the BTNS status.

- --