Subject: [anonsec] AD Review: Probably and Applicability Statement

From: hartmans-ietf at mit.edu (Sam Hartman)
Date: Tue, 24 Apr 2007 20:34:57 -0400

Hi, folks.  I've finished reviewing the Problem and Applicability
Statement draft.

I'd like to thank the authors for a lot of good work.

Several of the comments I made in my first review of the document
still haven't been fixed.  Terms like flash crowd, DDOS, zombies are
not defined before they are used.

Section 5.3 claims that passwords over anonymous channels are
inappropriate.  I don't think there is an ietf consensus behind this.
Replace
old:
Therefore, CBB must not be used with higher layer protocols
   that may expose sensitive information during authentication exchange.
   
with new:
Therefore, CBB must not be used with higher layer protocols
   that may expose sensitive information during authentication exchange where  the exposure of this information presents an unacceptable security risk.

I wonder if the working group has adequately reviewed section 5.7.  In
particular do we actually have a strong consensus that caching of BTNS
credentials is inappropriate?  We certainly have a lot of issues to
work through before we can recommend this caching.
But if there is no caching how is that leap of faith at all?

If there is such a consensus then Section 5.7 should be removed and a
section added to the applicability statement saying that leap of
faith/credential caching is out of scope.

Section 6 rules mobility, nat and multihoming out of scope.  Please
provide an argument that btns does not make issues associated with nat
and multihoming worse.  IN particular think about address selection
for inner addresses with anonymous open services and show that this
problem is not worse in a BTNS universe.

If you can do that then you can attempt to rule NAT and
multihoming/mobility out of scope.  I'll still call it out in the IETF
last call message and confirm that the community is willing to let you
rule this out of scope.

Sam Hartman
Security Area Director