Subject: Re: Fwd: ULE SEC REQ draft rev -03

From: Michael Noisternig <[email-masked]>
Date: Mon, 02 Jul 2007 13:55:46 +0200

Dear draft authors,

I am missing the following particular paragraph from my edits within 
section 3.1 (between the last and the but-last paragraph):

> However, the end-points of a communication might not be under central
> control (such as when browsing the public internet), and then it may not
> be possible to rely on end-to-end security. ULE link security will then
> provide protection against attacks on the weakest link within the
> communication chain, i.e. the ULE broadcast link (see section 3.2).

I think it is a case important enough to be outlined, i.e. a case where 
an "ordinary" end-user (compared to a company) has no possibility to 
enforce end-to-end security, yet he does not want "the whole world" to 
potentially see the data he receives (e.g. the web sites he visits).
It demonstrates another reason for why ULE link layer security is 
desirable, IMO.

Do you disagree?

(The wording of cited paragraph should be reworked in part, though.)

Michael

Gorry Fairhurst wrote:
> 
> Dear WG,
> 
> The draft below has been uploaded to the I-D archives (and will be 
> published soon), please send any comments you may have to this list, 
> particularly on the new sections.
> 
> Security requirements for the Unidirectional Lightweight Encapsulation 
> (ULE) protocol
> http://www.erg.abdn.ac.uk/ip-dvb/ids/draft-ietf-ipdvb-sec-req-03.txt
> 
> Best wishes,
> 
> Gorry Fairhurst
> 
> -------- Original Message --------
> Subject:     RE: ULE SEC REQ draft
> Date:     Wed, 27 Jun 2007 16:33:00 +0100
> From:     <[email-masked]>
> To:     <[email-masked]>
> CC:     <[email-masked]>, <[email-masked]>,
> <[email-masked]>, <[email-masked]>
> References:     <[email-masked]>
> 
> 
> 
> Hi All,
> 
> Please find attached the final version of the ULE-SEC-REQ drafts.
> We have incorporated all comments and suggestions:
> Here is the work history of the draft (v3):
> 
> Working Group Draft 03
>        o Fixed editorial mistakes and added some important changes as
>           pointed out by Gorry Fairhurst.
>        o Table 1 added in Section 6.2 to list the different security
>           techniques to mitigate the various possible network threats.
>        o Figure 2 modified to clearly explain the different interfaces
>           present in the framework.
>        o New Section 7 has been added.
>        o New Section 6 has been added.
>        o The previous sections 5 and 6 have been combined to section 5.
>        o Sections 3, 8 and 9 have been rearranged and updated with
>           comments and suggestions from Michael Noisternig from
>           University of Salzburg.
>        o The Authors and the Acknowledgments section have been updated.
> 
> 
> If there are no more comments we would like Gorry to publish this.
> 
> 
> Regards
> Sunny
> 
> ***********************************************************
> Sunil Iyengar,
> Research Fellow, Networks Group,
> Centre For Communication And Systems Research(CCSR),
> School of Electronics, Computing & Mathematics,
> University Of Surrey, Guildford GU2 7XH,
> Surrey, England, United Kingdom.
> Office: +44 (0)1483 686008
> ***********************************************************

---

From: Prashant Pillai <[email-masked]>
Date: Thu, 05 Jul 2007 12:44:06 +0100

Hi Michael,

Firstly thanks for your feedback amd comments to the draft.

Regarding this paragraph from your modifications. It was only removed because we
were not very comfortable with the wordings. See Inline

Quoting Michael Noisternig <[email-masked]>:

> > be possible to rely on end-to-end security.

End-to-end security has nothing to do with central control. Only the two
comunicating end parties are resposible for seting up any end-to-end security.
So this sentance is quite misleading as we should be able to use end-to-end
security withought any central control.

> > ULE link security will then

I am not sure if the ULE link would be the weakest link. Especially when data is
sent over the interent (the case of wesbites like you mention) I would consider
the fixed links to be vulnerable also.

> It demonstrates another reason for why ULE link layer security is

As discussed above, I also do not really see the point of only securing the ULE
link when the interet link is unsecured. Securing only part of the link IMO
will make the other link the weakest link.

> (The wording of cited paragraph should be reworked in part, though.)

Regards
Prashant

==========================================================
Dr Prashant Pillai
Mobile and Satellite Communications Research Centre (MSCRC)
School of Engineering, Design & Technology (EDT2)
University of Bradford
Bradford, West Yorkshire BD7 1DP.
Tel: +44(0)1274 233720
Email: [email-masked]
==========================================================
------------------------------------------------------------
This mail sent through IMP: http://webmail.brad.ac.uk
To report misuse from this email address forward the message
and full headers to [email-masked]
------------------------------------------------------------

---

From: Michael Noisternig <[email-masked]>
Date: Fri, 06 Jul 2007 14:54:36 +0200

Hi Prashant,

> were not very comfortable with the wordings. See Inline

I did not put much effort into the wordings because I had expected to 
get some feedback on that prior to publication. Sorry, I should have 
told so. :/

> security withought any central control.

Ok, what I mean is that if the destination end-point is not under the 
same control as the source, i.e. does not have the same owner (as a 
person/company), then you are restricted to whatever security the 
destination offers you. If it does not offer any security, there is no 
way to enforce it. E.g., this is true for most of the web servers in the 
www.

To repeat, in such case having security for the vulnerable (in terms of 
passive attacks) ULE broadcast link is very desirable.

> the fixed links to be vulnerable also.

Sure, the other links are vulnerable, too, if you don't have end-to-end 
security. But compared to the ULE broadcast link wired links are much 
more secure. On the ULE broadcast link, all it takes an attacker is to 
switch his receiver into some kind of promiscious mode to derive passive 
attacks. To succeed in any kind of attack on a wired link of the 
Internet requires much more sophistication. That is why I said that the 
ULE link was the weakest link in the communication chain. (Yes, I do not 
like the wording myself, it was just to get the point.)

> will make the other link the weakest link.

As explained above, it will make it quite harder to derive successful 
attacks. You'd have to tap specific wired links the data travels over, 
or get access to the routers in between.

Best regards,
Michael

---

From: <[email-masked]>
Date: Tue, 10 Jul 2007 15:06:40 +0100

Hi Michael and Prashant,
I Agree with Prashants view on this. The reason being it is already mentioned in the draft that wired links are difficult to intercept. IMO this case is very confusing without adding much to the draft. I propose we let it be as it is. If there are no further comments we are going to submit this version for the last call. 

Best Regards
Sunny  

-----Original Message-----
From: [email-masked] on behalf of Michael Noisternig
Sent: Fri 06/07/2007 13:54
To: Prashant Pillai
Cc: [email-masked]
Subject: Re: Fwd: ULE SEC REQ draft rev -03
 
Hi Prashant,

Best regards,
Michael

---

From: Michael Noisternig <[email-masked]>
Date: Tue, 10 Jul 2007 17:01:29 +0200

Hi,

> I Agree with Prashants view on this. The reason being it is already 
> mentioned in the draft that wired links are difficult to intercept. IMO 

Right. But my point was not to state once more that the wireless ULE 
broadcast link is more vulnerable but to present a showcase where there 
is no way to enforce end-to-end security, and thus to point out more 
explicitely that a solution for securing the ULE link only is very 
desirable.
This is in contrast to the current draft which only says
"...if authentication of the end-point i.e. the IP Sources is required,
        or users are concerned about loss of confidentiality, integrity
        or authenticity of their communication data, they will have to
        employ end-to-end network security mechanisms like IPSec or
        Transport Layer Security (TLS)."

> this case is very confusing without adding much to the draft. I propose 
> we let it be as it is. If there are no further comments we are going to 
> submit this version for the last call.
> 
> 
> Best Regards
> Sunny

---

From: Gorry Fairhurst <[email-masked]>
Date: Tue, 10 Jul 2007 16:47:39 +0100

I'm not sure what the issue is here. The paragraph that was cited form 
I-D seems to be speaking about authentication, which ultimately becomes 
a host-to-host (or security gateway-to-security gateway, etc).

Your text seems to touch on something different: If you are suggesting 
motivating the advantage of securing the "weakest" link (which at least 
for eaves-dropping, could be the broadcast link), then this seems a 
reasonable thing to point to in the introduction perhaps?

Gorry

Michael Noisternig wrote:
>> this case is very confusing without adding much to the draft. I 
>> propose we let it be as it is. If there are no further comments we are 
>> going to submit this version for the last call.
>>
>>
>> Best Regards
>> Sunny 
> 
> 
>

---

From: "Allison, Art" <[email-masked]>
Date: Tue, 10 Jul 2007 15:40:02 -0400

Is this envisioned attack against the satellite receiver?  If so, what
about the rest of the transmitted stream? That is so why is just this TS
packet data that needs to be so protected... Seem a bigger (out of
scope?) issue...

On the other hand, if you are referring to other wireless  'broadcast'
directly to individual sites...and you didn't see my previous
contribution about that threat...perhaps I need to provide it again.

_____________
Art Allison
Director, Advanced Engineering
Science & Technology
National Association of Broadcasters
1771 N Street, NW
Washington, D.C. 20036
Phone: 202.429.5418
Fax: 202.777.4981
[email-masked]

The National Association of Broadcasters is a trade association that
advocates on behalf of more than 8,300 free, local radio and television
stations and also broadcast networks before Congress, the Federal
Communications Commission and the Courts.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Gorry Fairhurst
Sent: Tuesday, July 10, 2007 11:48 AM
To: [email-masked]
Subject: Re: Fwd: ULE SEC REQ draft rev -03

Gorry

Michael Noisternig wrote:
> broadcast link is more vulnerable but to present a showcase where 
> there is no way to enforce end-to-end security, and thus to point out 
> more explicitely that a solution for securing the ULE link only is 
> very desirable.
> This is in contrast to the current draft which only says "...if 
> authentication of the end-point i.e. the IP Sources is required,
>> propose we let it be as it is. If there are no further comments we 
>> are going to submit this version for the last call.
>>
>>
>> Best Regards
>> Sunny
> 
> 
>

---

From: Michael Noisternig <[email-masked]>
Date: Wed, 11 Jul 2007 17:00:43 +0200

> reasonable thing to point to in the introduction perhaps?

Well, about, actually the paragraphs I'm refering to seem to do exactly 
that, trying to motivate securing the ULE link. What I'm missing in 
(between) those paragraphs is that _not_ having end-to-end security is 
not always simply a matter of choice ("...for users who choose not to 
implement end-to-end security mechanisms.") but it may be impossible to 
enforce it, so users would like to have at least _some_ security 
(confidentiality), namely for the "weakest" link, which would be the ULE 
link.
[This is what I was trying to say with the paragraph I was missing from 
my edits, btw.]

I am not sure if I can make myself clearer. I think it should be in 
there but if other people think different I will not be pushing this 
anymore.

Regards,
Michael