Subject: [Dots] Can DOTS protocol support IP whitelist for DOTS client's AA?

From: "Xialiang (Frank)" <[email-masked]>
Date: Mon, 7 Aug 2017 00:52:18 +0000

Hi,
I think the direct use of IP whitelist on the DOTS server to authenticate and authorize the DOTS client is a simple and effect method, at least in some special use cases, like: DOTS client does not support certificate, an ISP which detects the spoofed source address, etc.

So, should we support this as an optional way for the DOTS client's AA and add it into the DOTS protocol drafts?

B.R.
Frank

---

From: "Xialiang (Frank)" <[email-masked]>
Date: Mon, 7 Aug 2017 00:55:01 +0000

In addition to IP whitelist and certificate, pre-share key can also be an option.
Right?

发件人: Dots [mailto:[email-masked]] 代表 Xialiang (Frank)
发送时间: 2017年8月7日 8:52
收件人: [email-masked]
主题: [Dots] Can DOTS protocol support IP whitelist for DOTS client's AA?

Hi,

So, should we support this as an optional way for the DOTS client’s AA and add it into the DOTS protocol drafts?

B.R.
Frank

---

From: Artyom Gavrichenkov <[email-masked]>
Date: Mon, 7 Aug 2017 05:03:59 +0300

Hi there,

Current DOTS requirements draft goes to great lengths to protect a
DOTS connection from a passive attacker capturing packets on the way
from a client to a server and back (SEC-001, SEC-002, SEC-003,
DATA-002). One can come up with a handful of use cases where it's
important. Enabling a DOTS server to skip the certificate auth in
favour of the simple IP auth obviously violates this requirement.
Moreover, given recent ongoing research attempts on spoofing TCP
connections with either PRNG prediction or simple brute force ([1],
[2]) -- and yes, it's still rather easy to protect a network service
from such attacks, but it's currently not required from a DOTS server
to implement such protection -- I'd further say the IP auth sans
decent encryption is not suitable for a network service like that.

But of course that may be only me.

[1] http://lgms.nl/blog-7
[2] https://security.stackexchange.com/questions/107036/didnt-understood-what-the-purpose-of-the-newly-discovered-tcp-faking-attack

| Artyom Gavrichenkov
| gpg: 2deb 97b1 0a3c 151d b67f 1ee5 00e7 94bc 4d08 9191
| mailto: [email-masked]
| fb: ximaera
| telegram: xima_era
| skype: xima_era
| tel. no: +7 916 515 49 58

On Mon, Aug 7, 2017 at 3:52 AM, Xialiang (Frank)
<[email-masked]> wrote:
> Hi,
>
> I think the direct use of IP whitelist on the DOTS server to authenticate
> and authorize the DOTS client is a simple and effect method, at least in
> some special use cases, like: DOTS client does not support certificate, an
> ISP which detects the spoofed source address, etc.
>
>
>
> _______________________________________________
> Dots mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dots
>

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Mon, 7 Aug 2017 09:50:31 +0000

TLS supports pre-shared key based authentication. The other mechanisms are Subject Public Key Info (SPKI) Fingerprint pin set for mutual authentication (self-signed certificates or raw public keys) without having to deal with CA.

I don’t think DOTS should relax the mutual authentication and encryption requirements.

-TIru

From: Dots [mailto:[email-masked]] On Behalf Of Xialiang (Frank)
Sent: Monday, August 7, 2017 6:25 AM
To: [email-masked]
Subject: [Dots] another option://答复: Can DOTS protocol support IP whitelist for DOTS client's AA?

发件人: Dots [mailto:[email-masked]] 代表 Xialiang (Frank)
发送时间: 2017年8月7日 8:52
收件人: [email-masked]<mailto:[email-masked]>
主题: [Dots] Can DOTS protocol support IP whitelist for DOTS client's AA?

Hi,

B.R.
Frank

---

From: "Xialiang (Frank)" <[email-masked]>
Date: Mon, 7 Aug 2017 09:58:13 +0000

Hi Tiru,
Thanks for your analysis. It makes sense to me~~

To be accurate, IP whitelist does not relax the mutual authentication requirement, but indeed lose the encryption benefits.

B.R.
Frank

发件人: Konda, Tirumaleswar Reddy [mailto:[email-masked]]
发送时间: 2017年8月7日 17:51
收件人: Xialiang (Frank); [email-masked]
主题: RE: another option://答复: Can DOTS protocol support IP whitelist for DOTS client's AA?

-TIru

From: Dots [mailto:[email-masked]] On Behalf Of Xialiang (Frank)
Sent: Monday, August 7, 2017 6:25 AM
To: [email-masked]<mailto:[email-masked]>
Subject: [Dots] another option://答复: Can DOTS protocol support IP whitelist for DOTS client's AA?

Hi,

B.R.
Frank

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Mon, 7 Aug 2017 10:19:10 +0000

You may want to look into https://tools.ietf.org/html/rfc6959#section-7
<snip>
   Even if every Internet-connected network implements source address
   validation at the ultimate network ingress, and assurances exist that
   intermediate devices are to never modify datagram source addresses,
   source addresses cannot be used as an authentication mechanism.

-Tiru

From: Xialiang (Frank) [mailto:[email-masked]]
Sent: Monday, August 7, 2017 3:28 PM
To: Konda, Tirumaleswar Reddy <[email-masked]>; [email-masked]
Subject: 答复: another option://答复: Can DOTS protocol support IP whitelist for DOTS client's AA?

Hi Tiru,

B.R.
Frank

发件人: Konda, Tirumaleswar Reddy [mailto:[email-masked]]
发送时间: 2017年8月7日 17:51
收件人: Xialiang (Frank); [email-masked]<mailto:[email-masked]>
主题: RE: another option://答复: Can DOTS protocol support IP whitelist for DOTS client's AA?

-TIru

Hi,

B.R.
Frank