From opsec-bounces@ietf.org Sun Mar 2 08:40:51 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5B5423A69E3; Sun, 2 Mar 2008 08:40:51 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.586 X-Spam-Level: X-Spam-Status: No, score=-0.586 tagged_above=-999 required=5 tests=[AWL=-0.149, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eY76gBcbtLNp; Sun, 2 Mar 2008 08:40:45 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1E9A23A6CF1; Sun, 2 Mar 2008 08:40:35 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D16203A6AA6 for ; Sun, 2 Mar 2008 08:40:33 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BUCXFCJ-zLKi for ; Sun, 2 Mar 2008 08:40:28 -0800 (PST) Received: from wf-out-1314.google.com (wf-out-1314.google.com [209.85.200.174]) by core3.amsl.com (Postfix) with ESMTP id C60153A6D83 for ; Sun, 2 Mar 2008 08:37:49 -0800 (PST) Received: by wf-out-1314.google.com with SMTP id 25so5983906wfa.31 for ; Sun, 02 Mar 2008 08:37:41 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; bh=XyfwY+Thq8ZXAL6cFFyY772AVKh+sGTX2d3YYUBLUoA=; b=Oh+5MXjp5zWR5kw1Y7O77O2MG+2occOyw/oEQP3AWPjEPBV2dtnRJ3IxeCL2tCxix7luBJbVnt/yctiD0y8A/On4mwYa0AsPkUy3G634vPsmsASP6QOsQzyQlTCyir/m2hF42sjrT08I1eFeJaKVgf7WQKcilcwsLuEmzy3JtfA= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=AQwNCxinfIWAU0GPpTXCq96nSLGA3WWhvEsdgvz5l4hi8rgwzgWuVlaJNrsdgJNKUscsv20oPcSqRJ5GfN73xPilzyfmVUXfKJ1SQ+NFJNI9sBI1omuoc5J5SkvAMH7s0iCmKF96HeOU7ANzCoqxmixcZO/AVXEpdBqSGW2Q/GM= Received: by 10.142.89.9 with SMTP id m9mr8404181wfb.116.1204475861520; Sun, 02 Mar 2008 08:37:41 -0800 (PST) Received: by 10.143.164.14 with HTTP; Sun, 2 Mar 2008 08:37:41 -0800 (PST) Message-ID: <77ead0ec0803020837s16bccee8ledbc9ae1bb60e117@mail.gmail.com> Date: Sun, 2 Mar 2008 08:37:41 -0800 From: "Vishwas Manral" To: "Sandra Murphy" In-Reply-To: MIME-Version: 1.0 Content-Disposition: inline References: <47C4E38E.1070105@bogus.com> <77ead0ec0802272031j6d958279tf3028c4096093020@mail.gmail.com> <77ead0ec0802280649k66671fc9s9fc24314963c68a0@mail.gmail.com> <77ead0ec0802280956s3dcff81cx25fd152ea1c798fb@mail.gmail.com> <77ead0ec0802281056y2862d71dt8b753f5f3f3b0df9@mail.gmail.com> <77ead0ec0802281102o3e2efedl479ff6351dca0f63@mail.gmail.com> Cc: opsec wg mailing list , Stephen Kent , sidr@ietf.org Subject: Re: [OPSEC] [Sidr] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org Hi Sandra, I also noted the services of RIPE are currently accessible through http and not https. That is an issue too. I have notified RIPE about the same. Thanks, Vishwas On Thu, Feb 28, 2008 at 1:12 PM, Sandra Murphy wrote: > > > On Thu, 28 Feb 2008, Vishwas Manral wrote: > > > Hi Sandra, > > > > > To further clarify, > >> The only point I want to add to the discussion is because we have to > >> verify the Origin only in the first hop peer, we do not need a global > >> database (as I mentioned we are not saving against malicious attacks > >> in any case). > > This would mean for someone who gets the information from RIPE does > > not need to necessarily use the mechanism the way it currently stands. > > > > > As long as: > > (a) you were interested in protecting only those prefixes that are managed > by RIPE - data in RIPE about other prefixes doesn't fall under the > protection of their security model, and the RIPE database does not > contain all prefixes, > > and > > (b) you were comfortable with the trust model of RIPE (they authenticate > the upload of the data with varying strength of authentication and you > must get the data, whose aussurance you can not yourself verify, from them > and only them with a protected transport they support). > > As an additional wrinkle, I believe that RIPE does allocate prefixes to > LIRs. I do not know if the LIRs are required to maintain the RIPE > security model in their allocations. > > --Sandy > _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Tue Mar 4 07:05:03 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4B17E28C2C4; Tue, 4 Mar 2008 07:05:03 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.862 X-Spam-Level: X-Spam-Status: No, score=-0.862 tagged_above=-999 required=5 tests=[AWL=-0.425, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id F2c-peVot4d2; Tue, 4 Mar 2008 07:05:02 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1F9FA3A6B9D; Tue, 4 Mar 2008 07:05:02 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CC0773A6B13; Tue, 4 Mar 2008 07:05:00 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7arVd+tQJKfh; Tue, 4 Mar 2008 07:04:57 -0800 (PST) Received: from monster.hopcount.ca (monster.hopcount.ca [199.212.90.4]) by core3.amsl.com (Postfix) with ESMTP id 02F0F3A6ABA; Tue, 4 Mar 2008 07:04:56 -0800 (PST) Received: from [199.212.90.17] (helo=yxu1a17.hopcount.ca) by monster.hopcount.ca with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.68 (FreeBSD)) (envelope-from ) id 1JWYhA-000Abi-4R; Tue, 04 Mar 2008 15:04:44 +0000 Message-Id: <7C9DBE28-7B7A-4053-85AE-4B954FFEEC57@ca.afilias.info> From: Joe Abley To: Vishwas Manral In-Reply-To: <77ead0ec0803020837s16bccee8ledbc9ae1bb60e117@mail.gmail.com> Mime-Version: 1.0 (Apple Message framework v919.2) Date: Tue, 4 Mar 2008 10:04:43 -0500 References: <47C4E38E.1070105@bogus.com> <77ead0ec0802272031j6d958279tf3028c4096093020@mail.gmail.com> <77ead0ec0802280649k66671fc9s9fc24314963c68a0@mail.gmail.com> <77ead0ec0802280956s3dcff81cx25fd152ea1c798fb@mail.gmail.com> <77ead0ec0802281056y2862d71dt8b753f5f3f3b0df9@mail.gmail.com> <77ead0ec0802281102o3e2efedl479ff6351dca0f63@mail.gmail.com> <77ead0ec0803020837s16bccee8ledbc9ae1bb60e117@mail.gmail.com> X-Mailer: Apple Mail (2.919.2) Cc: opsec wg mailing list , sidr@ietf.org, Sandra Murphy , Stephen Kent Subject: Re: [OPSEC] [Sidr] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org On 2-Mar-2008, at 11:37, Vishwas Manral wrote: > I also noted the services of RIPE are currently accessible through > http and not https. That is an issue too. An issue for what or whom? And what do you mean by "the services"? Joe _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Tue Mar 4 07:14:50 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BE41A28C3BC; Tue, 4 Mar 2008 07:14:50 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.769 X-Spam-Level: X-Spam-Status: No, score=-0.769 tagged_above=-999 required=5 tests=[AWL=-0.332, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id l3A1Zb9UybGE; Tue, 4 Mar 2008 07:14:45 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4C87D3A69FD; Tue, 4 Mar 2008 07:14:45 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 78AE33A6C75 for ; Tue, 4 Mar 2008 07:14:43 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0Cga6Hy7ILud for ; Tue, 4 Mar 2008 07:14:37 -0800 (PST) Received: from gv-out-0910.google.com (gv-out-0910.google.com [216.239.58.186]) by core3.amsl.com (Postfix) with ESMTP id 3E1F028C5D3 for ; Tue, 4 Mar 2008 07:14:25 -0800 (PST) Received: by gv-out-0910.google.com with SMTP id i36so715857gve.15 for ; Tue, 04 Mar 2008 07:14:15 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; bh=k/yYZKStv3qTTZ6BX/QhYNcSo2p2G+woeg0+cAooibo=; b=nDkNoATIG9cXM2OT+F4cMcv3pWt6Hegw9aKPSFOQ4qp8srX9owNNzlaLDn77py2jQXFxKUP/qk5jFMc6S3zyyxUIJcOJvqoe9AFIDyHS7epshCFzxU6HaNOzXvmAKLljcPDegjiW1LJ2dv0Hb6D2Crv3WglqgWBKHosHvGe1GA4= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=QM5IPWstXMaKV2wCwpLVHTpqf4troZbFZvU/LUvi5+PVyfovfhB1izTCFtwZXF1rThi5N4Ur985HCjEnv4G/EA05bRk+6oqsEPst45yQTk8TcR/W1ercbtI+572JtzMRL+Y+HcOI2t3Bhi22BkhDB05P2szrKR6W7rflLPmlKiI= Received: by 10.142.52.9 with SMTP id z9mr528293wfz.237.1204643654013; Tue, 04 Mar 2008 07:14:14 -0800 (PST) Received: by 10.143.164.14 with HTTP; Tue, 4 Mar 2008 07:14:13 -0800 (PST) Message-ID: <77ead0ec0803040714v4235cff2u65bd247694e30570@mail.gmail.com> Date: Tue, 4 Mar 2008 07:14:13 -0800 From: "Vishwas Manral" To: "Joe Abley" In-Reply-To: <7C9DBE28-7B7A-4053-85AE-4B954FFEEC57@ca.afilias.info> MIME-Version: 1.0 Content-Disposition: inline References: <47C4E38E.1070105@bogus.com> <77ead0ec0802280649k66671fc9s9fc24314963c68a0@mail.gmail.com> <77ead0ec0802280956s3dcff81cx25fd152ea1c798fb@mail.gmail.com> <77ead0ec0802281056y2862d71dt8b753f5f3f3b0df9@mail.gmail.com> <77ead0ec0802281102o3e2efedl479ff6351dca0f63@mail.gmail.com> <77ead0ec0803020837s16bccee8ledbc9ae1bb60e117@mail.gmail.com> <7C9DBE28-7B7A-4053-85AE-4B954FFEEC57@ca.afilias.info> Cc: opsec wg mailing list , sidr@ietf.org, Sandra Murphy , Stephen Kent Subject: Re: [OPSEC] [Sidr] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org Hi Joe, I was talking about the RIPE whois and other related tools that RIPE provides, when I looked at the link given below: http://www.ripe.net/news/study-youtube-hijacking.html As the tools cannot be accessed using https but using http, the tools cannot be used in a guaranteed fashion. We cannot build scripts over the tools and feel the information. Thanks, Vishwas On Tue, Mar 4, 2008 at 7:04 AM, Joe Abley wrote: > > On 2-Mar-2008, at 11:37, Vishwas Manral wrote: > > > I also noted the services of RIPE are currently accessible through > > http and not https. That is an issue too. > > An issue for what or whom? And what do you mean by "the services"? > > > Joe > > _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Tue Mar 4 07:19:39 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B19FC28C24F; Tue, 4 Mar 2008 07:19:39 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.432 X-Spam-Level: X-Spam-Status: No, score=-1.432 tagged_above=-999 required=5 tests=[AWL=-0.995, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ph6ZyY68SToM; Tue, 4 Mar 2008 07:19:39 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 03D8D3A6E3E; Tue, 4 Mar 2008 07:19:16 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 19D0B3A6E3E for ; Tue, 4 Mar 2008 07:19:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AMAspK4WrNHR for ; Tue, 4 Mar 2008 07:19:09 -0800 (PST) Received: from ind-iport-1.cisco.com (ind-iport-1.cisco.com [64.104.129.195]) by core3.amsl.com (Postfix) with ESMTP id AB02828C5F7 for ; Tue, 4 Mar 2008 07:18:57 -0800 (PST) X-IronPort-AV: E=Sophos;i="4.25,444,1199644200"; d="scan'208";a="98920913" Received: from hkg-dkim-1.cisco.com ([10.75.231.161]) by ind-iport-1.cisco.com with ESMTP; 04 Mar 2008 20:48:44 +0530 Received: from hkg-core-1.cisco.com (hkg-core-1.cisco.com [64.104.123.94]) by hkg-dkim-1.cisco.com (8.12.11/8.12.11) with ESMTP id m24FIioT030058 for ; Tue, 4 Mar 2008 23:18:44 +0800 Received: from [192.168.1.100] (hkidc-vpn-client-234-61.cisco.com [10.75.234.61]) by hkg-core-1.cisco.com (8.13.8/8.13.8) with ESMTP id m24FIhYr002448 for ; Tue, 4 Mar 2008 15:18:43 GMT Message-Id: <102D139D-C09A-49F8-9716-8FD3130344A5@cisco.com> From: Roland Dobbins To: opsec wg mailing list In-Reply-To: <77ead0ec0803040714v4235cff2u65bd247694e30570@mail.gmail.com> Mime-Version: 1.0 (Apple Message framework v915) Date: Tue, 4 Mar 2008 22:18:42 +0700 References: <47C4E38E.1070105@bogus.com> <77ead0ec0802280649k66671fc9s9fc24314963c68a0@mail.gmail.com> <77ead0ec0802280956s3dcff81cx25fd152ea1c798fb@mail.gmail.com> <77ead0ec0802281056y2862d71dt8b753f5f3f3b0df9@mail.gmail.com> <77ead0ec0802281102o3e2efedl479ff6351dca0f63@mail.gmail.com> <77ead0ec0803020837s16bccee8ledbc9ae1bb60e117@mail.gmail.com> <7C9DBE28-7B7A-4053-85AE-4B954FFEEC57@ca.afilias.info> <77ead0ec0803040714v4235cff2u65bd247694e30570@mail.gmail.com> X-Mailer: Apple Mail (2.915) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=717; t=1204643924; x=1205507924; c=relaxed/simple; s=hkgdkim1002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=rdobbins@cisco.com; z=From:=20Roland=20Dobbins=20 |Subject:=20Re=3A=20[OPSEC]=20[Sidr]=20pccw=20as17557=20lea k... |Sender:=20; bh=KoctSA1E63tI+qxUINQUPqSN0baSkIgxsTDuA5eeTrM=; b=J6DUQ2ypyTM2oteOSYTQVnvRxBBL38kafwx4nFnSUHiaqEYxFo0G8fGpjV pRp6eBze8tjF9G4JO/DGTg/KuO7Ncwt7bunp+Er5A0RjADGQwKpuDkrTBNa6 BetW8NvJXdsmseLxuzE1YYlrHr/1KmoJFdbMvvpMQghJmNALcNoyY=; Authentication-Results: hkg-dkim-1; header.From=rdobbins@cisco.com; dkim=pass ( sig from cisco.com/hkgdkim1002 verified; ); Subject: Re: [OPSEC] [Sidr] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org [removed cross-post to sidr list; folks, cross-posting is considered poor form and is a breach of netiquette, please don't do it] On Mar 4, 2008, at 10:14 PM, Vishwas Manral wrote: > the tools cannot be used in a guaranteed fashion. How does the use of SSL 'guarantee' anything except that you're talking to what you think you're talking to, heh? What kind of 'guarantee' is that, since it doesn't ensure the integrity nor the correctness of the data? ----------------------------------------------------------------------- Roland Dobbins // +66.83.266.6344 mobile If you don't know what to do, it's harder to do it. -- Malcolm Forbes _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Tue Mar 4 07:25:44 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A44E628C4F4; Tue, 4 Mar 2008 07:25:44 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.817 X-Spam-Level: X-Spam-Status: No, score=-0.817 tagged_above=-999 required=5 tests=[AWL=-0.380, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OKMmzACWq9bz; Tue, 4 Mar 2008 07:25:38 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9EC2728C475; Tue, 4 Mar 2008 07:25:24 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7FCAB28C202; Tue, 4 Mar 2008 07:25:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2FqjPofLolkx; Tue, 4 Mar 2008 07:25:17 -0800 (PST) Received: from monster.hopcount.ca (monster.hopcount.ca [199.212.90.4]) by core3.amsl.com (Postfix) with ESMTP id 9FB7628C57C; Tue, 4 Mar 2008 07:22:55 -0800 (PST) Received: from [199.212.90.17] (helo=yxu1a17.hopcount.ca) by monster.hopcount.ca with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.68 (FreeBSD)) (envelope-from ) id 1JWYyX-000AhO-8M; Tue, 04 Mar 2008 15:22:43 +0000 Message-Id: <5B7F4259-8CAB-4895-8F26-8BFD0CE7C56B@ca.afilias.info> From: Joe Abley To: Vishwas Manral In-Reply-To: <77ead0ec0803040714v4235cff2u65bd247694e30570@mail.gmail.com> Mime-Version: 1.0 (Apple Message framework v919.2) Date: Tue, 4 Mar 2008 10:22:39 -0500 References: <47C4E38E.1070105@bogus.com> <77ead0ec0802280649k66671fc9s9fc24314963c68a0@mail.gmail.com> <77ead0ec0802280956s3dcff81cx25fd152ea1c798fb@mail.gmail.com> <77ead0ec0802281056y2862d71dt8b753f5f3f3b0df9@mail.gmail.com> <77ead0ec0802281102o3e2efedl479ff6351dca0f63@mail.gmail.com> <77ead0ec0803020837s16bccee8ledbc9ae1bb60e117@mail.gmail.com> <7C9DBE28-7B7A-4053-85AE-4B954FFEEC57@ca.afilias.info> <77ead0ec0803040714v4235cff2u65bd247694e30570@mail.gmail.com> X-Mailer: Apple Mail (2.919.2) Cc: opsec wg mailing list , sidr@ietf.org, Sandra Murphy , Stephen Kent Subject: Re: [OPSEC] [Sidr] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org On 4-Mar-2008, at 10:14, Vishwas Manral wrote: > I was talking about the RIPE whois and other related tools that RIPE > provides, when I looked at the link given below: > http://www.ripe.net/news/study-youtube-hijacking.html > > As the tools cannot be accessed using https but using http, the tools > cannot be used in a guaranteed fashion. We cannot build scripts over > the tools and feel the information. I had no idea they were available over http. Everybody I know who uses them uses whois. As to "cannot build", that doesn't seem to be an opinion shared by the many ISPs who "have built". Joe _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Tue Mar 4 07:29:51 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DC7DB28C4B5; Tue, 4 Mar 2008 07:29:51 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.588 X-Spam-Level: X-Spam-Status: No, score=-0.588 tagged_above=-999 required=5 tests=[AWL=-0.151, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id N66eYcSM2SgB; Tue, 4 Mar 2008 07:29:46 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A382E28C5DA; Tue, 4 Mar 2008 07:29:38 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 47D6D28C57C for ; Tue, 4 Mar 2008 07:29:38 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4UggQo27jzgG for ; Tue, 4 Mar 2008 07:29:34 -0800 (PST) Received: from wf-out-1314.google.com (wf-out-1314.google.com [209.85.200.168]) by core3.amsl.com (Postfix) with ESMTP id A5DA928C5D3 for ; Tue, 4 Mar 2008 07:28:01 -0800 (PST) Received: by wf-out-1314.google.com with SMTP id 25so1121275wfa.31 for ; Tue, 04 Mar 2008 07:27:52 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; bh=EP6rZzrEy0mdKBlsIMgUakBhEe6oalsdc3+e8+fKKWk=; b=LYZrTmTX92NLLdtuLACtV+CXBYAECJGBlgzNXOlwYrDoM08fFGy2PMnIbw3modFkRAMPMcWnweMvSBgLqGpBRj/NOShHqNohowoKhRrRGoclLrAGk8orxyZZcq0xceuvPN7WuittIdj/c8i+WgtLz/0TK+Mwf1M/RqDlWqRLlL0= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=R1EO14JrdNBMc/xrZ37tpacyRlGItQwGEG4w6RGw/qdFBX+ZJYYkoxE/wJGbDlNoxKaPmXHsOveztR5kTzffIIEUdGA6SqtWODHZiidPT7br28vnBbxoKlc4dAGFBcNEH+vnuF31VuiHVyM32Iwy/hvpXwTtW3DtS5cOKAHUlt4= Received: by 10.143.37.20 with SMTP id p20mr528315wfj.236.1204644472445; Tue, 04 Mar 2008 07:27:52 -0800 (PST) Received: by 10.143.164.14 with HTTP; Tue, 4 Mar 2008 07:27:52 -0800 (PST) Message-ID: <77ead0ec0803040727n24b68e0fm5650e8fb6c1b1dc@mail.gmail.com> Date: Tue, 4 Mar 2008 07:27:52 -0800 From: "Vishwas Manral" To: "Joe Abley" In-Reply-To: <5B7F4259-8CAB-4895-8F26-8BFD0CE7C56B@ca.afilias.info> MIME-Version: 1.0 Content-Disposition: inline References: <47C4E38E.1070105@bogus.com> <77ead0ec0802280956s3dcff81cx25fd152ea1c798fb@mail.gmail.com> <77ead0ec0802281056y2862d71dt8b753f5f3f3b0df9@mail.gmail.com> <77ead0ec0802281102o3e2efedl479ff6351dca0f63@mail.gmail.com> <77ead0ec0803020837s16bccee8ledbc9ae1bb60e117@mail.gmail.com> <7C9DBE28-7B7A-4053-85AE-4B954FFEEC57@ca.afilias.info> <77ead0ec0803040714v4235cff2u65bd247694e30570@mail.gmail.com> <5B7F4259-8CAB-4895-8F26-8BFD0CE7C56B@ca.afilias.info> Cc: opsec wg mailing list , sidr@ietf.org, Sandra Murphy , Stephen Kent Subject: Re: [OPSEC] [Sidr] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org Hi Joe, > I had no idea they were available over http. Everybody I know who uses > them uses whois. > > As to "cannot build", that doesn't seem to be an opinion shared by the > many ISPs who "have built". The point I raise is about a guarantee of talking to the right server. If the tools are already built and are not checking the certificate of the site they are getting the information from, then that is another weakness in the system, that is breakable. Thanks, Vishwas On Tue, Mar 4, 2008 at 7:22 AM, Joe Abley wrote: > > On 4-Mar-2008, at 10:14, Vishwas Manral wrote: > > > I was talking about the RIPE whois and other related tools that RIPE > > provides, when I looked at the link given below: > > http://www.ripe.net/news/study-youtube-hijacking.html > > > > As the tools cannot be accessed using https but using http, the tools > > cannot be used in a guaranteed fashion. We cannot build scripts over > > the tools and feel the information. > > I had no idea they were available over http. Everybody I know who uses > them uses whois. > > As to "cannot build", that doesn't seem to be an opinion shared by the > many ISPs who "have built". > > > Joe > _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Tue Mar 4 07:34:30 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 93DDE28C6AB; Tue, 4 Mar 2008 07:34:30 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.392 X-Spam-Level: X-Spam-Status: No, score=-1.392 tagged_above=-999 required=5 tests=[AWL=-0.955, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xejVRXTsOsvZ; Tue, 4 Mar 2008 07:34:25 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 78FF128C5FA; Tue, 4 Mar 2008 07:34:20 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 648BC28C64B for ; Tue, 4 Mar 2008 07:34:18 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eXqTkIa4RXbO for ; Tue, 4 Mar 2008 07:34:17 -0800 (PST) Received: from ind-iport-1.cisco.com (ind-iport-1.cisco.com [64.104.129.195]) by core3.amsl.com (Postfix) with ESMTP id BEA593A699D for ; Tue, 4 Mar 2008 07:33:46 -0800 (PST) X-IronPort-AV: E=Sophos;i="4.25,444,1199644200"; d="scan'208";a="98921541" Received: from hkg-dkim-2.cisco.com ([10.75.231.163]) by ind-iport-1.cisco.com with ESMTP; 04 Mar 2008 21:03:36 +0530 Received: from hkg-core-1.cisco.com (hkg-core-1.cisco.com [64.104.123.94]) by hkg-dkim-2.cisco.com (8.12.11/8.12.11) with ESMTP id m24FXZ2Z008598 for ; Tue, 4 Mar 2008 23:33:35 +0800 Received: from [192.168.1.100] (hkidc-vpn-client-234-61.cisco.com [10.75.234.61]) by hkg-core-1.cisco.com (8.13.8/8.13.8) with ESMTP id m24FXYha004750 for ; Tue, 4 Mar 2008 15:33:34 GMT Message-Id: <9CFF53DD-9E88-4C97-9C3B-AF94525DD827@cisco.com> From: Roland Dobbins To: opsec wg mailing list In-Reply-To: <77ead0ec0803040727n24b68e0fm5650e8fb6c1b1dc@mail.gmail.com> Mime-Version: 1.0 (Apple Message framework v915) Date: Tue, 4 Mar 2008 22:33:33 +0700 References: <47C4E38E.1070105@bogus.com> <77ead0ec0802280956s3dcff81cx25fd152ea1c798fb@mail.gmail.com> <77ead0ec0802281056y2862d71dt8b753f5f3f3b0df9@mail.gmail.com> <77ead0ec0802281102o3e2efedl479ff6351dca0f63@mail.gmail.com> <77ead0ec0803020837s16bccee8ledbc9ae1bb60e117@mail.gmail.com> <7C9DBE28-7B7A-4053-85AE-4B954FFEEC57@ca.afilias.info> <77ead0ec0803040714v4235cff2u65bd247694e30570@mail.gmail.com> <5B7F4259-8CAB-4895-8F26-8BFD0CE7C56B@ca.afilias.info> <77ead0ec0803040727n24b68e0fm5650e8fb6c1b1dc@mail.gmail.com> X-Mailer: Apple Mail (2.915) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=698; t=1204644815; x=1205508815; c=relaxed/simple; s=hkgdkim2001; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=rdobbins@cisco.com; z=From:=20Roland=20Dobbins=20 |Subject:=20Re=3A=20[OPSEC]=20[Sidr]=20pccw=20as17557=20lea k... |Sender:=20; bh=NapT7YMkrmrudaLgL4vf9ZHchKMdy7acxt4q9LZlr6w=; b=b9Fzh4iAskZKif005B18YKb2E6DKrlUtbB56LAtmJVWFizGu185vmrMtSk i5uP6Rt/M07+z64WwuzUDyEJCXoceZf+RvtiVqP29lY7E9gqXI+OeDV/DvbR cYZy2WfIqJf6lc3amy76KSBT3z5jK+8YzDj4hE81m3h1wn0YBgSik=; Authentication-Results: hkg-dkim-2; header.From=rdobbins@cisco.com; dkim=pass ( sig from cisco.com/hkgdkim2001 verified; ); Subject: Re: [OPSEC] [Sidr] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org On Mar 4, 2008, at 10:27 PM, Vishwas Manral wrote: > The point I raise is about a guarantee of talking to the right server. Since this doesn't guarantee the correctness/validity of the data, doesn't that mean that the use of certificates is a waste of time, anyways? Or are you *now* stating that we shouldn't make the perfect the enemy of the merely good? ;> As Joe indicates, most tools access that data via whois, anyways, FYI. ----------------------------------------------------------------------- Roland Dobbins // +66.83.266.6344 mobile If you don't know what to do, it's harder to do it. -- Malcolm Forbes _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Tue Mar 4 07:35:10 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 572F528C23E; Tue, 4 Mar 2008 07:35:10 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.589 X-Spam-Level: X-Spam-Status: No, score=-0.589 tagged_above=-999 required=5 tests=[AWL=-0.152, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id crQNBDgvKmiQ; Tue, 4 Mar 2008 07:35:10 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 067B428C652; Tue, 4 Mar 2008 07:34:49 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E764828C5F9 for ; Tue, 4 Mar 2008 07:34:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1CwoyusNy8gB for ; Tue, 4 Mar 2008 07:34:42 -0800 (PST) Received: from wf-out-1314.google.com (wf-out-1314.google.com [209.85.200.173]) by core3.amsl.com (Postfix) with ESMTP id 5D43B3A6B3A for ; Tue, 4 Mar 2008 07:34:37 -0800 (PST) Received: by wf-out-1314.google.com with SMTP id 25so1126381wfa.31 for ; Tue, 04 Mar 2008 07:34:28 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; bh=p6lN01BrhGJsP9LLuZ/NUqxC+0+EP2Zbuw/A7q36cNY=; b=nyRmunYLZugTOaPrTZhd5IXZ5BUqyaGGTEFulMab5Hd6WokB89ESYG7YSMnekWRlumkYkVS2lQ8NcDU44AJz1q0nmEnI6Fz8tJ0KXPoClk0laQVqfhi3u8zSRa5GxRqtxXXOjdipifUXcDv7vxVu/+BRD7fqJaAcYMx6cZBmQ0s= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=B8f7CqrL43R469FaYn1Ow48ByjZOVbVx9jQcpsoEHJ3qF7IKDgjSj6Mgj/Gdc9wd1e825oNCRZfwzaevcLLleLXcmXJGtk9Uz8WWoq5GvwqFmSF66DTRQPThnZtxGU8FKLFvr8ZIj2MAhE94kmxj7U3dcbcEc0jrbFT2lpJm4QE= Received: by 10.142.79.15 with SMTP id c15mr555123wfb.105.1204644868087; Tue, 04 Mar 2008 07:34:28 -0800 (PST) Received: by 10.143.164.14 with HTTP; Tue, 4 Mar 2008 07:34:27 -0800 (PST) Message-ID: <77ead0ec0803040734j1029d341m3c12fe112d59a9bf@mail.gmail.com> Date: Tue, 4 Mar 2008 07:34:27 -0800 From: "Vishwas Manral" To: "Roland Dobbins" In-Reply-To: <102D139D-C09A-49F8-9716-8FD3130344A5@cisco.com> MIME-Version: 1.0 Content-Disposition: inline References: <47C4E38E.1070105@bogus.com> <77ead0ec0802280956s3dcff81cx25fd152ea1c798fb@mail.gmail.com> <77ead0ec0802281056y2862d71dt8b753f5f3f3b0df9@mail.gmail.com> <77ead0ec0802281102o3e2efedl479ff6351dca0f63@mail.gmail.com> <77ead0ec0803020837s16bccee8ledbc9ae1bb60e117@mail.gmail.com> <7C9DBE28-7B7A-4053-85AE-4B954FFEEC57@ca.afilias.info> <77ead0ec0803040714v4235cff2u65bd247694e30570@mail.gmail.com> <102D139D-C09A-49F8-9716-8FD3130344A5@cisco.com> Cc: opsec wg mailing list Subject: Re: [OPSEC] [Sidr] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org Hi Roland, > How does the use of SSL 'guarantee' anything except that you're > talking to what you think you're talking to, heh? You may be missing the point here. There are two phases of getting the information from the RIPE servers. One is whether we are talking to the right server, second is whether RIPE is getting the right information. Both are just as critical. If we are to make decisions in our network based on information from RIPE (tools that have been built), we have to make sure we are actually getting the information from RIPE and not some other site. It is the same reason all your banking transactions are done over https. Thanks, Vishwas On Tue, Mar 4, 2008 at 7:18 AM, Roland Dobbins wrote: > > [removed cross-post to sidr list; folks, cross-posting is considered > poor form and is a breach of netiquette, please don't do it] > > > On Mar 4, 2008, at 10:14 PM, Vishwas Manral wrote: > > > the tools cannot be used in a guaranteed fashion. > > How does the use of SSL 'guarantee' anything except that you're > talking to what you think you're talking to, heh? What kind of > 'guarantee' is that, since it doesn't ensure the integrity nor the > correctness of the data? > > > ----------------------------------------------------------------------- > Roland Dobbins // +66.83.266.6344 mobile > > If you don't know what to do, it's harder to do it. > > -- Malcolm Forbes > > > > > > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec > _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Tue Mar 4 07:37:24 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E9A7B28C68B; Tue, 4 Mar 2008 07:37:24 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.594 X-Spam-Level: X-Spam-Status: No, score=-0.594 tagged_above=-999 required=5 tests=[AWL=-0.157, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VEdPMcrwT0iO; Tue, 4 Mar 2008 07:37:24 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3CF1C28C671; Tue, 4 Mar 2008 07:37:02 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 49D5728C652 for ; Tue, 4 Mar 2008 07:37:01 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ee3uNXGuCL1d for ; Tue, 4 Mar 2008 07:36:55 -0800 (PST) Received: from wf-out-1314.google.com (wf-out-1314.google.com [209.85.200.174]) by core3.amsl.com (Postfix) with ESMTP id 1BCB73A6D6A for ; Tue, 4 Mar 2008 07:36:51 -0800 (PST) Received: by wf-out-1314.google.com with SMTP id 25so1128010wfa.31 for ; Tue, 04 Mar 2008 07:36:41 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; bh=04mFTwuhMDACRBKjOPwpHNZr9fc0lRqs0W/8dBf2r7I=; b=bLA1mXbhbkP/tniX1DzeQWDHNHSp0Z7ud6E+1Xs47RFabf2IXkqXQP8X3UvLARCNZIb2pYfYCMAMnMQst6BZEoy1XSQQtQEVpWmkS3cGbkQ+MKN4sVEz3h9kX6aBS8Vp/yxFTFMH0it/YHjkpB9fH3jtCb+8MW9dOMnY7eqdCh0= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=nvpEcCqCzlt4RPpsg6J96/bAp3mGOaiSldWGfwVG6g7gcA/IB48lhqOTkFiVvPNUspPWq15BtjnTwwNDsLiVfQaFfIeYNAeLK2fBHn0BFwY9KF7BX1UXLtnhx31Hw3c+hcC8tcYLGgzakONzM9AqMecJaAI4s276IGJzRoIsosQ= Received: by 10.143.187.2 with SMTP id o2mr544507wfp.162.1204645001899; Tue, 04 Mar 2008 07:36:41 -0800 (PST) Received: by 10.143.164.14 with HTTP; Tue, 4 Mar 2008 07:36:41 -0800 (PST) Message-ID: <77ead0ec0803040736t55871ebex445e6fe31d6ac129@mail.gmail.com> Date: Tue, 4 Mar 2008 07:36:41 -0800 From: "Vishwas Manral" To: "Joe Abley" In-Reply-To: <77ead0ec0803040727n24b68e0fm5650e8fb6c1b1dc@mail.gmail.com> MIME-Version: 1.0 Content-Disposition: inline References: <47C4E38E.1070105@bogus.com> <77ead0ec0802281056y2862d71dt8b753f5f3f3b0df9@mail.gmail.com> <77ead0ec0802281102o3e2efedl479ff6351dca0f63@mail.gmail.com> <77ead0ec0803020837s16bccee8ledbc9ae1bb60e117@mail.gmail.com> <7C9DBE28-7B7A-4053-85AE-4B954FFEEC57@ca.afilias.info> <77ead0ec0803040714v4235cff2u65bd247694e30570@mail.gmail.com> <5B7F4259-8CAB-4895-8F26-8BFD0CE7C56B@ca.afilias.info> <77ead0ec0803040727n24b68e0fm5650e8fb6c1b1dc@mail.gmail.com> Cc: opsec wg mailing list , sidr@ietf.org, Sandra Murphy , Stephen Kent Subject: Re: [OPSEC] [Sidr] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org Hi Joe, To further explain it. In my view SSL is the right protocol for this kind of transaction (we could use IPSec with BTNS too though). As the idea is to get the information from the right server, the client itself could be any one. Thanks, Vishwas On Tue, Mar 4, 2008 at 7:27 AM, Vishwas Manral wrote: > Hi Joe, > > > > I had no idea they were available over http. Everybody I know who uses > > them uses whois. > > > > As to "cannot build", that doesn't seem to be an opinion shared by the > > many ISPs who "have built". > The point I raise is about a guarantee of talking to the right server. > If the tools are already built and are not checking the certificate of > the site they are getting the information from, then that is another > weakness in the system, that is breakable. > > Thanks, > Vishwas > > > > On Tue, Mar 4, 2008 at 7:22 AM, Joe Abley wrote: > > > > On 4-Mar-2008, at 10:14, Vishwas Manral wrote: > > > > > I was talking about the RIPE whois and other related tools that RIPE > > > provides, when I looked at the link given below: > > > http://www.ripe.net/news/study-youtube-hijacking.html > > > > > > As the tools cannot be accessed using https but using http, the tools > > > cannot be used in a guaranteed fashion. We cannot build scripts over > > > the tools and feel the information. > > > > I had no idea they were available over http. Everybody I know who uses > > them uses whois. > > > > As to "cannot build", that doesn't seem to be an opinion shared by the > > many ISPs who "have built". > > > > > > Joe > > > _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Tue Mar 4 07:43:47 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AB7C73A6E10; Tue, 4 Mar 2008 07:43:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.811 X-Spam-Level: X-Spam-Status: No, score=-0.811 tagged_above=-999 required=5 tests=[AWL=-0.374, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4XnXXxXsdPGk; Tue, 4 Mar 2008 07:43:47 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D4C473A6D2E; Tue, 4 Mar 2008 07:43:39 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 48FBE28C116; Tue, 4 Mar 2008 07:43:39 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id r+xFREIN-mHx; Tue, 4 Mar 2008 07:43:34 -0800 (PST) Received: from monster.hopcount.ca (monster.hopcount.ca [199.212.90.4]) by core3.amsl.com (Postfix) with ESMTP id CFDEA3A6D2E; Tue, 4 Mar 2008 07:43:33 -0800 (PST) Received: from [199.212.90.17] (helo=yxu1a17.hopcount.ca) by monster.hopcount.ca with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.68 (FreeBSD)) (envelope-from ) id 1JWZIY-000B37-Tu; Tue, 04 Mar 2008 15:43:23 +0000 Message-Id: <6AAD8CE4-1A16-4C8D-A883-EC5D4D80D2FD@ca.afilias.info> From: Joe Abley To: "Vishwas Manral" In-Reply-To: <77ead0ec0803040736t55871ebex445e6fe31d6ac129@mail.gmail.com> Mime-Version: 1.0 (Apple Message framework v919.2) Date: Tue, 4 Mar 2008 10:43:21 -0500 References: <47C4E38E.1070105@bogus.com> <77ead0ec0802281056y2862d71dt8b753f5f3f3b0df9@mail.gmail.com> <77ead0ec0802281102o3e2efedl479ff6351dca0f63@mail.gmail.com> <77ead0ec0803020837s16bccee8ledbc9ae1bb60e117@mail.gmail.com> <7C9DBE28-7B7A-4053-85AE-4B954FFEEC57@ca.afilias.info> <77ead0ec0803040714v4235cff2u65bd247694e30570@mail.gmail.com> <5B7F4259-8CAB-4895-8F26-8BFD0CE7C56B@ca.afilias.info> <77ead0ec0803040727n24b68e0fm5650e8fb6c1b1dc@mail.gmail.com> <77ead0ec0803040736t55871ebex445e6fe31d6ac129@mail.gmail.com> X-Mailer: Apple Mail (2.919.2) Cc: opsec wg mailing list , sidr@ietf.org, Sandra Murphy , Stephen Kent Subject: Re: [OPSEC] [Sidr] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org On 4-Mar-2008, at 10:36, Vishwas Manral wrote: > To further explain it. In my view SSL is the right protocol for this > kind of transaction (we could use IPSec with BTNS too though). As the > idea is to get the information from the right server, the client > itself could be any one. That seems like a feasible band-aid over the deficiencies of the existing service, although it's clearly no panacea. It also has the practical problem that existing scripts that use whois would need modification, although the whois "protocol" and client are so trivial that it would presumably be straightforward for someone to implement a change to the (say) BSD client to implement an SSL wrapper with server- side certificate verification. Allowing the integrity of the data itself to be trusted (e.g. using the resource certification work) seems like a more appropriate direction than worrying about the security of data retrieval, though, which perhaps explains why SSL-wrapping whois has not already been done by anybody. Joe _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Tue Mar 4 07:44:07 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 63C5B28C64E; Tue, 4 Mar 2008 07:44:07 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.382 X-Spam-Level: X-Spam-Status: No, score=-1.382 tagged_above=-999 required=5 tests=[AWL=-0.945, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YIWOGadu7xt9; Tue, 4 Mar 2008 07:44:06 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 41A9428C57C; Tue, 4 Mar 2008 07:44:06 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3681E28C510 for ; Tue, 4 Mar 2008 07:44:05 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xPb47zf77j5U for ; Tue, 4 Mar 2008 07:43:59 -0800 (PST) Received: from ind-iport-1.cisco.com (ind-iport-1.cisco.com [64.104.129.195]) by core3.amsl.com (Postfix) with ESMTP id 611E928C5F9 for ; Tue, 4 Mar 2008 07:43:54 -0800 (PST) X-IronPort-AV: E=Sophos;i="4.25,444,1199644200"; d="scan'208";a="98921947" Received: from hkg-dkim-1.cisco.com ([10.75.231.161]) by ind-iport-1.cisco.com with ESMTP; 04 Mar 2008 21:13:44 +0530 Received: from hkg-core-1.cisco.com (hkg-core-1.cisco.com [64.104.123.94]) by hkg-dkim-1.cisco.com (8.12.11/8.12.11) with ESMTP id m24FhhFc031814 for ; Tue, 4 Mar 2008 23:43:43 +0800 Received: from [192.168.1.100] (hkidc-vpn-client-234-61.cisco.com [10.75.234.61]) by hkg-core-1.cisco.com (8.13.8/8.13.8) with ESMTP id m24FhYiZ006272 for ; Tue, 4 Mar 2008 15:43:42 GMT Message-Id: <0F12A797-6CC9-4D94-A46F-8BFCFFAA9863@cisco.com> From: Roland Dobbins To: opsec wg mailing list In-Reply-To: <77ead0ec0803040734j1029d341m3c12fe112d59a9bf@mail.gmail.com> Mime-Version: 1.0 (Apple Message framework v915) Date: Tue, 4 Mar 2008 22:43:34 +0700 References: <47C4E38E.1070105@bogus.com> <77ead0ec0802280956s3dcff81cx25fd152ea1c798fb@mail.gmail.com> <77ead0ec0802281056y2862d71dt8b753f5f3f3b0df9@mail.gmail.com> <77ead0ec0802281102o3e2efedl479ff6351dca0f63@mail.gmail.com> <77ead0ec0803020837s16bccee8ledbc9ae1bb60e117@mail.gmail.com> <7C9DBE28-7B7A-4053-85AE-4B954FFEEC57@ca.afilias.info> <77ead0ec0803040714v4235cff2u65bd247694e30570@mail.gmail.com> <102D139D-C09A-49F8-9716-8FD3130344A5@cisco.com> <77ead0ec0803040734j1029d341m3c12fe112d59a9bf@mail.gmail.com> X-Mailer: Apple Mail (2.915) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=1830; t=1204645423; x=1205509423; c=relaxed/simple; s=hkgdkim1002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=rdobbins@cisco.com; z=From:=20Roland=20Dobbins=20 |Subject:=20Re=3A=20[OPSEC]=20[Sidr]=20pccw=20as17557=20lea k... |Sender:=20; bh=0mhsLTv6wmbbOHDGK1EcWeXfGFPw167bcOWRQeGLWk4=; b=ML4GH9VHVY8XYEw27o7jTy5JKVx/fX8JasskmrPQl4ZkAi6syO5jPaVdPn A3iF2iI0bYBKNOL3AOrq4pBFgWD3f0xCxGpkeYrnaVKCyZRdeNgw8eplTCdz tnsfgIk7w61h0bk7VdOP9aPwbETBzxwDi8Qr7E0EH0N0LMpkbYCMM=; Authentication-Results: hkg-dkim-1; header.From=rdobbins@cisco.com; dkim=pass ( sig from cisco.com/hkgdkim1002 verified; ); Subject: Re: [OPSEC] [Sidr] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org On Mar 4, 2008, at 10:34 PM, Vishwas Manral wrote: > If we are to make decisions in our network based on information from > RIPE (tools that have been built), we have to make sure we are > actually getting the information from RIPE and not some other site. I would submit to you that if your network is so compromised that you can't be sure you're talking to RIPE, you've problems mere technology can't solve, anyways. I would also submit that if the RIPE netblocks were hijacked, that folks would notice immediately. You seem to have a very low opinion of the level of security-related clue of the operational community, or at least the people on this list; why is that? Since RIPE data aren't available today via HTTPS, and since the policies derived from the RIPE data seem to work, and since the Internet in general seems to work, you might wish to reconsider lecturing those with actual operational experience about the basic principles of information security which they already understand better than most, and instead spend some time thinking about (and perhaps asking about, rather than making flat, uninformed statements about) why it is that folks haven't done various things which you seem to think are so blindingly obvious. To be clear, everyone here understand what HTTPS is and what certs are and what they're useful for and what they don't solve. We also understand all the rest of the basics (as well as quite advanced concepts) of information security. We don't need a primer, thanks just the same. ----------------------------------------------------------------------- Roland Dobbins // +66.83.266.6344 mobile If you don't know what to do, it's harder to do it. -- Malcolm Forbes _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Tue Mar 4 07:46:26 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2084028C4B3; Tue, 4 Mar 2008 07:46:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.328 X-Spam-Level: X-Spam-Status: No, score=-1.328 tagged_above=-999 required=5 tests=[AWL=-0.891, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id e647bPgn2qiN; Tue, 4 Mar 2008 07:46:20 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A64823A6B3A; Tue, 4 Mar 2008 07:46:20 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3674C3A6E10 for ; Tue, 4 Mar 2008 07:46:19 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dm2tEbRUOD+g for ; Tue, 4 Mar 2008 07:46:15 -0800 (PST) Received: from ind-iport-1.cisco.com (ind-iport-1.cisco.com [64.104.129.195]) by core3.amsl.com (Postfix) with ESMTP id 09EE93A6BFC for ; Tue, 4 Mar 2008 07:46:14 -0800 (PST) X-IronPort-AV: E=Sophos;i="4.25,444,1199644200"; d="scan'208";a="98922017" Received: from hkg-dkim-2.cisco.com ([10.75.231.163]) by ind-iport-1.cisco.com with ESMTP; 04 Mar 2008 21:16:05 +0530 Received: from hkg-core-1.cisco.com (hkg-core-1.cisco.com [64.104.123.94]) by hkg-dkim-2.cisco.com (8.12.11/8.12.11) with ESMTP id m24Fk2Ne009927 for ; Tue, 4 Mar 2008 23:46:02 +0800 Received: from [192.168.1.100] (hkidc-vpn-client-234-61.cisco.com [10.75.234.61]) by hkg-core-1.cisco.com (8.13.8/8.13.8) with ESMTP id m24Fk1IY006566 for ; Tue, 4 Mar 2008 15:46:01 GMT Message-Id: From: Roland Dobbins To: opsec wg mailing list In-Reply-To: <77ead0ec0803040736t55871ebex445e6fe31d6ac129@mail.gmail.com> Mime-Version: 1.0 (Apple Message framework v915) Date: Tue, 4 Mar 2008 22:46:00 +0700 References: <47C4E38E.1070105@bogus.com> <77ead0ec0802281056y2862d71dt8b753f5f3f3b0df9@mail.gmail.com> <77ead0ec0802281102o3e2efedl479ff6351dca0f63@mail.gmail.com> <77ead0ec0803020837s16bccee8ledbc9ae1bb60e117@mail.gmail.com> <7C9DBE28-7B7A-4053-85AE-4B954FFEEC57@ca.afilias.info> <77ead0ec0803040714v4235cff2u65bd247694e30570@mail.gmail.com> <5B7F4259-8CAB-4895-8F26-8BFD0CE7C56B@ca.afilias.info> <77ead0ec0803040727n24b68e0fm5650e8fb6c1b1dc@mail.gmail.com> <77ead0ec0803040736t55871ebex445e6fe31d6ac129@mail.gmail.com> X-Mailer: Apple Mail (2.915) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=752; t=1204645562; x=1205509562; c=relaxed/simple; s=hkgdkim2001; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=rdobbins@cisco.com; z=From:=20Roland=20Dobbins=20 |Subject:=20Re=3A=20[OPSEC]=20[Sidr]=20pccw=20as17557=20lea k... |Sender:=20; bh=FsMQ4ZC7145IRlOXCa862+ReVIgBZx4fAeh9H3pqvN8=; b=cEg9U/rQ2kaVHoFls2KeSXV5CtUzVctyklINVJG3WindfBRX2jgIJQkG83 uPqla3AMf46eeJiMdqMoH9BHGlX4gC6sVfKaBbG8z/MNRh7lPFJy+aOXEzSU jKuqX3ndt5L22MbJhDYYbBYXtXSbqFgdRdcRhJI/2fkoQDHlCYuts=; Authentication-Results: hkg-dkim-2; header.From=rdobbins@cisco.com; dkim=pass ( sig from cisco.com/hkgdkim2001 verified; ); Subject: Re: [OPSEC] [Sidr] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org [continuing to remove cross-posts to sidr] On Mar 4, 2008, at 10:36 PM, Vishwas Manral wrote: > In my view SSL is the right protocol for this > kind of transaction Correct, that's *your view*. If you feel very strongly about it, you may wish to query the RIPE folks as to why they aren't using it, and perhaps volunteer your services to help them implement it, if they deem it a useful idea, rather than explaining HTTPS concepts to folks who're already quite aware of how HTTPS works. ----------------------------------------------------------------------- Roland Dobbins // +66.83.266.6344 mobile If you don't know what to do, it's harder to do it. -- Malcolm Forbes _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Tue Mar 4 08:01:52 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C40E43A6C84; Tue, 4 Mar 2008 08:01:52 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.593 X-Spam-Level: X-Spam-Status: No, score=-0.593 tagged_above=-999 required=5 tests=[AWL=-0.156, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wr7HQ3UwrzIX; Tue, 4 Mar 2008 08:01:47 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4EADB28C266; Tue, 4 Mar 2008 08:00:39 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E195A3A68F9 for ; Tue, 4 Mar 2008 08:00:37 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HGAapQECCxcL for ; Tue, 4 Mar 2008 08:00:32 -0800 (PST) Received: from wf-out-1314.google.com (wf-out-1314.google.com [209.85.200.171]) by core3.amsl.com (Postfix) with ESMTP id 3771028C64E for ; Tue, 4 Mar 2008 07:59:49 -0800 (PST) Received: by wf-out-1314.google.com with SMTP id 25so1145111wfa.31 for ; Tue, 04 Mar 2008 07:59:39 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; bh=CmQsPS+7OVCXoNo+J60mpvILcChLxXb+NhnMeHI2lvk=; b=jcJfV5qLYSAxUxNQcbdDYz18jN51Xze08qMi/8gxwlYHRbCSpaKYQRrHv0XiMhOg4rr5MxMSuHBLBUWzSB4in93oh0SRTRXs6kFHQJHZeud23WbVwDkPZLlYZJD0/xYdgqGyDYdq8/N00MmYwHCd/DZbAhZn9XITQ5ojWQs1BKM= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=E9pdqV2PF5xqwmb1B5BSyZKIBXv3B40ESj8lSWe1WnPbDbpvg55gD4VQbZAOvie5CrdCZ0/R0Yf7rZnUHNopl1tLzqtmitVvj14e5GxhEQmkz3DLffhO8q/5cTLvu4YNaVnmRUIrkpuwLdpV2+l4VXgAnJxG7Ua5MtqdpEuSHmE= Received: by 10.142.156.2 with SMTP id d2mr539564wfe.219.1204646379295; Tue, 04 Mar 2008 07:59:39 -0800 (PST) Received: by 10.143.164.14 with HTTP; Tue, 4 Mar 2008 07:59:39 -0800 (PST) Message-ID: <77ead0ec0803040759p4fad1726m9e175625a13d04a6@mail.gmail.com> Date: Tue, 4 Mar 2008 07:59:39 -0800 From: "Vishwas Manral" To: "Joe Abley" In-Reply-To: <6AAD8CE4-1A16-4C8D-A883-EC5D4D80D2FD@ca.afilias.info> MIME-Version: 1.0 Content-Disposition: inline References: <47C4E38E.1070105@bogus.com> <77ead0ec0802281102o3e2efedl479ff6351dca0f63@mail.gmail.com> <77ead0ec0803020837s16bccee8ledbc9ae1bb60e117@mail.gmail.com> <7C9DBE28-7B7A-4053-85AE-4B954FFEEC57@ca.afilias.info> <77ead0ec0803040714v4235cff2u65bd247694e30570@mail.gmail.com> <5B7F4259-8CAB-4895-8F26-8BFD0CE7C56B@ca.afilias.info> <77ead0ec0803040727n24b68e0fm5650e8fb6c1b1dc@mail.gmail.com> <77ead0ec0803040736t55871ebex445e6fe31d6ac129@mail.gmail.com> <6AAD8CE4-1A16-4C8D-A883-EC5D4D80D2FD@ca.afilias.info> Cc: opsec wg mailing list , sidr@ietf.org, Sandra Murphy , Stephen Kent Subject: Re: [OPSEC] [Sidr] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org Hi Joe, If you saw the mail exchange between Sandra and I, you will notice she mentioned the reason they have to go ahead with SIDR even though we have tools available from RIPE. What I have been trying to do is to figure out weaknesses. in the current infrastructure to get a secure behavior. As a first step I found out this weakness and updated RIPE/ Daniel about the same. As we discussed earlier SIDR does not provide a totally secure infrastructure. The point here is that SIDR is giving some very basic improvements in the security, generally in the non-malicious case. The idea is can we get a similar security with the current infrastructure, by doing minor improvements. There is a certain cost involved with the SIDR infrastructure. I do not think the SSL channel has not been done because it is unnecessary. I guess there hasn't been an attack on that side of the infrastructure yet, but these are well known issues/ attacks in other fields. Thanks, Vishwas On Tue, Mar 4, 2008 at 7:43 AM, Joe Abley wrote: > > On 4-Mar-2008, at 10:36, Vishwas Manral wrote: > > > To further explain it. In my view SSL is the right protocol for this > > kind of transaction (we could use IPSec with BTNS too though). As the > > idea is to get the information from the right server, the client > > itself could be any one. > > That seems like a feasible band-aid over the deficiencies of the > existing service, although it's clearly no panacea. It also has the > practical problem that existing scripts that use whois would need > modification, although the whois "protocol" and client are so trivial > that it would presumably be straightforward for someone to implement a > change to the (say) BSD client to implement an SSL wrapper with server- > side certificate verification. > > Allowing the integrity of the data itself to be trusted (e.g. using > the resource certification work) seems like a more appropriate > direction than worrying about the security of data retrieval, though, > which perhaps explains why SSL-wrapping whois has not already been > done by anybody. > > > Joe > > _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Tue Mar 4 08:20:57 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CF47928C5AC; Tue, 4 Mar 2008 08:20:57 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.265 X-Spam-Level: X-Spam-Status: No, score=-1.265 tagged_above=-999 required=5 tests=[AWL=-0.828, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id F2keXBsxj3Bj; Tue, 4 Mar 2008 08:20:52 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6539628C57D; Tue, 4 Mar 2008 08:20:52 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C50CE28C5DA for ; Tue, 4 Mar 2008 08:20:50 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0rxFRre6egh6 for ; Tue, 4 Mar 2008 08:20:47 -0800 (PST) Received: from ind-iport-1.cisco.com (ind-iport-1.cisco.com [64.104.129.195]) by core3.amsl.com (Postfix) with ESMTP id 9E31628C312 for ; Tue, 4 Mar 2008 08:20:46 -0800 (PST) X-IronPort-AV: E=Sophos;i="4.25,444,1199644200"; d="scan'208";a="98923240" Received: from hkg-dkim-2.cisco.com ([10.75.231.163]) by ind-iport-1.cisco.com with ESMTP; 04 Mar 2008 21:50:36 +0530 Received: from hkg-core-1.cisco.com (hkg-core-1.cisco.com [64.104.123.94]) by hkg-dkim-2.cisco.com (8.12.11/8.12.11) with ESMTP id m24GKZpj013892 for ; Wed, 5 Mar 2008 00:20:35 +0800 Received: from [192.168.1.100] (hkidc-vpn-client-234-61.cisco.com [10.75.234.61]) by hkg-core-1.cisco.com (8.13.8/8.13.8) with ESMTP id m24GKYjj011968 for ; Tue, 4 Mar 2008 16:20:34 GMT Message-Id: From: Roland Dobbins To: opsec wg mailing list In-Reply-To: <77ead0ec0803040759p4fad1726m9e175625a13d04a6@mail.gmail.com> Mime-Version: 1.0 (Apple Message framework v915) Date: Tue, 4 Mar 2008 23:20:34 +0700 References: <47C4E38E.1070105@bogus.com> <77ead0ec0802281102o3e2efedl479ff6351dca0f63@mail.gmail.com> <77ead0ec0803020837s16bccee8ledbc9ae1bb60e117@mail.gmail.com> <7C9DBE28-7B7A-4053-85AE-4B954FFEEC57@ca.afilias.info> <77ead0ec0803040714v4235cff2u65bd247694e30570@mail.gmail.com> <5B7F4259-8CAB-4895-8F26-8BFD0CE7C56B@ca.afilias.info> <77ead0ec0803040727n24b68e0fm5650e8fb6c1b1dc@mail.gmail.com> <77ead0ec0803040736t55871ebex445e6fe31d6ac129@mail.gmail.com> <6AAD8CE4-1A16-4C8D-A883-EC5D4D80D2FD@ca.afilias.info> <77ead0ec0803040759p4fad1726m9e175625a13d04a6@mail.gmail.com> X-Mailer: Apple Mail (2.915) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=470; t=1204647635; x=1205511635; c=relaxed/simple; s=hkgdkim2001; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=rdobbins@cisco.com; z=From:=20Roland=20Dobbins=20 |Subject:=20Re=3A=20[OPSEC]=20[Sidr]=20pccw=20as17557=20lea k... |Sender:=20; bh=4jAJNM9W3FxG7BNMlQYeHwVz/m5k7TOyCN21za8Tbyg=; b=xXATCuXswtru8t7Eslawhu/XHrgKV/GyVHi+dz98uF0dOUHev6chufBGsw pPI4DckLJrj7X9g23xw2XfxhhlNrIgaFhqKtghJ9TXHgUHgQoAz6MTiois3C wAjU4qklo7lyR6q8t/fKHdLT4Gv95ezNb0LDW5N96TB5dDV6yrV8Q=; Authentication-Results: hkg-dkim-2; header.From=rdobbins@cisco.com; dkim=pass ( sig from cisco.com/hkgdkim2001 verified; ); Subject: Re: [OPSEC] [Sidr] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org [continuing to remove netiquette-breaching cross-post to the sidr list] On Mar 4, 2008, at 10:59 PM, Vishwas Manral wrote: > these are well known issues/ attacks in other fields. They're well-known in this field, too. ----------------------------------------------------------------------- Roland Dobbins // +66.83.266.6344 mobile If you don't know what to do, it's harder to do it. -- Malcolm Forbes _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Tue Mar 4 08:53:10 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 34F7628C77F; Tue, 4 Mar 2008 08:53:10 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.594 X-Spam-Level: X-Spam-Status: No, score=-0.594 tagged_above=-999 required=5 tests=[AWL=-0.157, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SRHAOez1iuQR; Tue, 4 Mar 2008 08:53:10 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CA9003A6EEC; Tue, 4 Mar 2008 08:51:20 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AA2A328C5DC for ; Tue, 4 Mar 2008 08:51:19 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yoyF+CEvKKlE for ; Tue, 4 Mar 2008 08:51:14 -0800 (PST) Received: from wf-out-1314.google.com (wf-out-1314.google.com [209.85.200.175]) by core3.amsl.com (Postfix) with ESMTP id 873D328C62A for ; Tue, 4 Mar 2008 08:49:50 -0800 (PST) Received: by wf-out-1314.google.com with SMTP id 25so1182935wfa.31 for ; Tue, 04 Mar 2008 08:49:41 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; bh=9f8fEQjfahLWFYmrfZ0DUHPkTOfhlMnVRHVSQugMqCM=; b=kjtXPuZS0oIYjoBcBB5c5LhesqbqkkR1xijD5xRO42PkQEJOzjuVcs2qkFcvUtjw7MPjteL/aTONUvZDpWw7h/ColkXaXbqXIxvQel4xtQfOuR2Crl7L5pqAcAMUyneni7Pv5YcpaPMI13K50wIPy0VbvUJ4/xSlohj3PEHg6P0= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=f+y/9gaE87TwzJlHQAol2PwEnRuYhVFnwzEG1Xz96cxPUBNNRiI2uuS/wzX8zsIsUuxxyAHuU5K5bDJdCmiK/osIOuHLsmWLBmJfgOn8jPHFGVX2zFfECyAl3swnB4ODJOrU4B7tUgqINRBbG1O0HJDPvqxe6rbRA7dx3qjvXTU= Received: by 10.142.241.10 with SMTP id o10mr560152wfh.155.1204649381292; Tue, 04 Mar 2008 08:49:41 -0800 (PST) Received: by 10.143.164.14 with HTTP; Tue, 4 Mar 2008 08:49:41 -0800 (PST) Message-ID: <77ead0ec0803040849x7f26aa13hdd8ce7f0489b938b@mail.gmail.com> Date: Tue, 4 Mar 2008 08:49:41 -0800 From: "Vishwas Manral" To: "Sandra Murphy" In-Reply-To: MIME-Version: 1.0 Content-Disposition: inline References: <47C4E38E.1070105@bogus.com> <77ead0ec0803020837s16bccee8ledbc9ae1bb60e117@mail.gmail.com> <7C9DBE28-7B7A-4053-85AE-4B954FFEEC57@ca.afilias.info> <77ead0ec0803040714v4235cff2u65bd247694e30570@mail.gmail.com> <5B7F4259-8CAB-4895-8F26-8BFD0CE7C56B@ca.afilias.info> <77ead0ec0803040727n24b68e0fm5650e8fb6c1b1dc@mail.gmail.com> <77ead0ec0803040736t55871ebex445e6fe31d6ac129@mail.gmail.com> <6AAD8CE4-1A16-4C8D-A883-EC5D4D80D2FD@ca.afilias.info> <77ead0ec0803040759p4fad1726m9e175625a13d04a6@mail.gmail.com> Cc: opsec wg mailing list , Stephen Kent , sidr@ietf.org Subject: Re: [OPSEC] [Sidr] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org Hi Sandra, You are right RIPE is not the only IRR. The reason I brought up RIPE is because it was mentioned that RIPE provides more secure services. If it is a good model, I would wonder why other IRR cannot do the same. > To be plain, to say SIDR addresses only non-malicious cases is flat out > WRONG. (And sorry for not having pointed that out before, I thought I > did.) Sandra, yes you mentioned it clearly in your mail. Let me put an analogy for the same and let me know if our differences of opinions match, We have 4 glasses on a window and one of them has been made fully bulletproof at a big expense. The point you raise is it protects when you hit against the glass that has been made bulletproof. The point I bring out is that if at a cheaper cost we can harden the glasses it may be a better option. That is what I mean by non-malicious intent. I guess that is the difference of opinion we have. Thanks, Vishwas On Tue, Mar 4, 2008 at 8:34 AM, Sandra Murphy wrote: > > > On Tue, 4 Mar 2008, Vishwas Manral wrote: > > > Hi Joe, > > > > If you saw the mail exchange between Sandra and I, you will notice she > > mentioned the reason they have to go ahead with SIDR even though we > > have tools available from RIPE. What I have been trying to do is to > > figure out weaknesses. in the current infrastructure to get a secure > > behavior. As a first step I found out this weakness and updated RIPE/ > > Daniel about the same. > > Please keep in mind that RIPE is not the only IRR. And RIPE can not > verify authorization for prefixes and ASs outside its range. So improving > RIPE does not buy you what you want. > > > > > > > As we discussed earlier SIDR does not provide a totally secure > > infrastructure. The point here is that SIDR is giving some very basic > > improvements in the security, generally in the non-malicious case. > > Please keep in mind that I have said SIDR does most definitely protect > against malicious attacks for those attacks it is addressing. > > SIDR makes no difference between maliciousness or carelessness in the > attacks it counters. > > There are plenty of malicious and accidental ways to attack routers that > are not in the realm of what SIDR is considering now. Maliciousness is > not the distinguisher here. > > To be plain, to say SIDR addresses only non-malicious cases is flat out > WRONG. (And sorry for not having pointed that out before, I thought I > did.) > > > > > The > > idea is can we get a similar security with the current infrastructure, > > by doing minor improvements. There is a certain cost involved with the > > SIDR infrastructure. > > No, we cannot get similar security with current infrastructure, even with > MAJOR improvements to the security of the current infrastructure. The > structure of the current infrastructure does not permit similar security > to what the RPKI provides. > > Unless, of course, you want to add all RPKI features to the IRR model, so > that the IRR becomes the same as the RPKI. Of course, you adopt the cost > as well. > > --Sandy > > > > > > I do not think the SSL channel has not been done because it is > > unnecessary. I guess there hasn't been an attack on that side of the > > infrastructure yet, but these are well known issues/ attacks in other > > fields. > > > > Thanks, > > Vishwas > > > > > _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Tue Mar 4 10:20:44 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9682E28C50E; Tue, 4 Mar 2008 10:20:44 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.596 X-Spam-Level: X-Spam-Status: No, score=-0.596 tagged_above=-999 required=5 tests=[AWL=-0.159, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dLWu+Vs0W4Ph; Tue, 4 Mar 2008 10:20:39 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2229E28C40C; Tue, 4 Mar 2008 10:20:39 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2B27F3A6B0A for ; Tue, 4 Mar 2008 10:20:38 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wk2eBVip2LYZ for ; Tue, 4 Mar 2008 10:20:32 -0800 (PST) Received: from wf-out-1314.google.com (wf-out-1314.google.com [209.85.200.170]) by core3.amsl.com (Postfix) with ESMTP id C43DA3A6CEF for ; Tue, 4 Mar 2008 10:20:32 -0800 (PST) Received: by wf-out-1314.google.com with SMTP id 25so1250899wfa.31 for ; Tue, 04 Mar 2008 10:20:23 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; bh=Muny5Xl5iDX3u7GdecsQBI88FxpwccNEkRxlW1LWhug=; b=rPp7WpgX8NdfUVFGW8UPXSBHKZ8V7cjnOeT5OwYVcG81jsTyfk5iPuPIMGyohPhCqCXCjiWiS3I003JxbvQFohiQJ0f2qUveII0HtMu8/9et4ZJHx4xeas7cz9ELaNQ0H0aJgQDNIlkFALWlp37KPE+tsdBkvhibtVcq4RblmCo= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=EA/raxN1fbPtYqv4y4EYC5LnhVOAYL3OgJM5ZUwpvozLLVBLTUJsbSSzEvp0VQ42/8+VBk0TfpmEZMvo6ngy7U7H6aQyXGtXzLwQ55bYh9gVZoVRSSCzav4lYl/wfR/1hwnHFc68GxVgIXvYOeoo5S7y//TKy4iYhDgbhJT6JxU= Received: by 10.142.11.2 with SMTP id 2mr561026wfk.233.1204654821804; Tue, 04 Mar 2008 10:20:21 -0800 (PST) Received: by 10.143.164.14 with HTTP; Tue, 4 Mar 2008 10:20:21 -0800 (PST) Message-ID: <77ead0ec0803041020j55cab2cdka91e3885d2b5d5ec@mail.gmail.com> Date: Tue, 4 Mar 2008 10:20:21 -0800 From: "Vishwas Manral" To: "Roland Dobbins" In-Reply-To: MIME-Version: 1.0 Content-Disposition: inline References: <47C4E38E.1070105@bogus.com> <77ead0ec0803020837s16bccee8ledbc9ae1bb60e117@mail.gmail.com> <7C9DBE28-7B7A-4053-85AE-4B954FFEEC57@ca.afilias.info> <77ead0ec0803040714v4235cff2u65bd247694e30570@mail.gmail.com> <5B7F4259-8CAB-4895-8F26-8BFD0CE7C56B@ca.afilias.info> <77ead0ec0803040727n24b68e0fm5650e8fb6c1b1dc@mail.gmail.com> <77ead0ec0803040736t55871ebex445e6fe31d6ac129@mail.gmail.com> <6AAD8CE4-1A16-4C8D-A883-EC5D4D80D2FD@ca.afilias.info> <77ead0ec0803040759p4fad1726m9e175625a13d04a6@mail.gmail.com> Cc: opsec wg mailing list Subject: Re: [OPSEC] [Sidr] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org Hi Roland, Thanks for bringing forward the breach to keep us on track and continuously reminding us. It seems the reason every one has been cross-posting(including the chairs of both the groups) is because the same may be of interest to the two mailing lists. Thanks again, Vishwas On Tue, Mar 4, 2008 at 8:20 AM, Roland Dobbins wrote: > > [continuing to remove netiquette-breaching cross-post to the sidr list] > > > On Mar 4, 2008, at 10:59 PM, Vishwas Manral wrote: > > > these are well known issues/ attacks in other fields. > > They're well-known in this field, too. > > > ----------------------------------------------------------------------- > Roland Dobbins // +66.83.266.6344 mobile > > If you don't know what to do, it's harder to do it. > > -- Malcolm Forbes > > > > > _______________________________________________ > > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec > _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Tue Mar 4 16:11:57 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4971228C666; Tue, 4 Mar 2008 16:11:57 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.801 X-Spam-Level: X-Spam-Status: No, score=-0.801 tagged_above=-999 required=5 tests=[AWL=-0.364, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qYY-493rw8eP; Tue, 4 Mar 2008 16:11:56 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8AC7928C6A5; Tue, 4 Mar 2008 16:11:50 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1FFEE28C666 for ; Tue, 4 Mar 2008 16:11:50 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aypjYy2VHTZO for ; Tue, 4 Mar 2008 16:11:49 -0800 (PST) Received: from monster.hopcount.ca (monster.hopcount.ca [199.212.90.4]) by core3.amsl.com (Postfix) with ESMTP id 3AE1328C670 for ; Tue, 4 Mar 2008 16:11:47 -0800 (PST) Received: from [199.212.90.17] (helo=yxu1a17.hopcount.ca) by monster.hopcount.ca with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.68 (FreeBSD)) (envelope-from ) id 1JWhEI-000FhZ-Qx; Wed, 05 Mar 2008 00:11:35 +0000 Message-Id: <3BAC289C-A6E6-4104-95AA-BB18CA0E967D@ca.afilias.info> From: Joe Abley To: Vishwas Manral In-Reply-To: <77ead0ec0803040734j1029d341m3c12fe112d59a9bf@mail.gmail.com> Mime-Version: 1.0 (Apple Message framework v919.2) Date: Tue, 4 Mar 2008 19:11:29 -0500 References: <47C4E38E.1070105@bogus.com> <77ead0ec0802280956s3dcff81cx25fd152ea1c798fb@mail.gmail.com> <77ead0ec0802281056y2862d71dt8b753f5f3f3b0df9@mail.gmail.com> <77ead0ec0802281102o3e2efedl479ff6351dca0f63@mail.gmail.com> <77ead0ec0803020837s16bccee8ledbc9ae1bb60e117@mail.gmail.com> <7C9DBE28-7B7A-4053-85AE-4B954FFEEC57@ca.afilias.info> <77ead0ec0803040714v4235cff2u65bd247694e30570@mail.gmail.com> <102D139D-C09A-49F8-9716-8FD3130344A5@cisco.com> <77ead0ec0803040734j1029d341m3c12fe112d59a9bf@mail.gmail.com> X-Mailer: Apple Mail (2.919.2) Cc: opsec wg mailing list Subject: Re: [OPSEC] [Sidr] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org On 4-Mar-2008, at 10:34, Vishwas Manral wrote: > You may be missing the point here. There are two phases of getting the > information from the RIPE servers. One is whether we are talking to > the right server, second is whether RIPE is getting the right > information. Both are just as critical. In practice, if I can verify that the data is accurate, I don't care where I got it from. I'm not sure where this discussion is going, except round in circles (I've made the point above before, I think). Joe _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Mar 5 08:08:32 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6914B3A6F20; Wed, 5 Mar 2008 08:08:32 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.625 X-Spam-Level: X-Spam-Status: No, score=-0.625 tagged_above=-999 required=5 tests=[AWL=-0.188, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id N-ZI0rsKzNNv; Wed, 5 Mar 2008 08:08:31 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C6F0028C84E; Wed, 5 Mar 2008 08:08:13 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 62AEF28C6F5; Tue, 4 Mar 2008 08:35:42 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pCRMZmcwWFjy; Tue, 4 Mar 2008 08:35:36 -0800 (PST) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by core3.amsl.com (Postfix) with ESMTP id CE26A28C6F4; Tue, 4 Mar 2008 08:34:38 -0800 (PST) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.13.5/8.13.5) with ESMTP id m24GYJdG026841; Tue, 4 Mar 2008 10:34:19 -0600 Received: from nemo.columbia.ads.sparta.com (nemo.columbia.sparta.com [157.185.80.75]) by Beta5.sparta.com (8.12.11/8.13.1) with ESMTP id m24GYJd8029474; Tue, 4 Mar 2008 10:34:19 -0600 Received: from localhost ([157.185.81.106]) by nemo.columbia.ads.sparta.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.3959); Tue, 4 Mar 2008 11:34:19 -0500 Date: Tue, 4 Mar 2008 11:34:18 -0500 (Eastern Standard Time) From: Sandra Murphy To: Vishwas Manral In-Reply-To: <77ead0ec0803040759p4fad1726m9e175625a13d04a6@mail.gmail.com> Message-ID: References: <47C4E38E.1070105@bogus.com> <77ead0ec0802281102o3e2efedl479ff6351dca0f63@mail.gmail.com> <77ead0ec0803020837s16bccee8ledbc9ae1bb60e117@mail.gmail.com> <7C9DBE28-7B7A-4053-85AE-4B954FFEEC57@ca.afilias.info> <77ead0ec0803040714v4235cff2u65bd247694e30570@mail.gmail.com> <5B7F4259-8CAB-4895-8F26-8BFD0CE7C56B@ca.afilias.info> <77ead0ec0803040727n24b68e0fm5650e8fb6c1b1dc@mail.gmail.com> <77ead0ec0803040736t55871ebex445e6fe31d6ac129@mail.gmail.com> <6AAD8CE4-1A16-4C8D-A883-EC5D4D80D2FD@ca.afilias.info> <77ead0ec0803040759p4fad1726m9e175625a13d04a6@mail.gmail.com> X-X-Sender: sandy@nemo.columbia.sparta.com MIME-Version: 1.0 X-OriginalArrivalTime: 04 Mar 2008 16:34:19.0190 (UTC) FILETIME=[9822F560:01C87E15] X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-3.0 (M4.sparta.com [157.185.61.2]); Tue, 04 Mar 2008 10:34:19 -0600 (CST) X-Mailman-Approved-At: Wed, 05 Mar 2008 08:08:13 -0800 Cc: opsec wg mailing list , Stephen Kent , sidr@ietf.org Subject: Re: [OPSEC] [Sidr] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org On Tue, 4 Mar 2008, Vishwas Manral wrote: > Hi Joe, > > If you saw the mail exchange between Sandra and I, you will notice she > mentioned the reason they have to go ahead with SIDR even though we > have tools available from RIPE. What I have been trying to do is to > figure out weaknesses. in the current infrastructure to get a secure > behavior. As a first step I found out this weakness and updated RIPE/ > Daniel about the same. Please keep in mind that RIPE is not the only IRR. And RIPE can not verify authorization for prefixes and ASs outside its range. So improving RIPE does not buy you what you want. > > As we discussed earlier SIDR does not provide a totally secure > infrastructure. The point here is that SIDR is giving some very basic > improvements in the security, generally in the non-malicious case. Please keep in mind that I have said SIDR does most definitely protect against malicious attacks for those attacks it is addressing. SIDR makes no difference between maliciousness or carelessness in the attacks it counters. There are plenty of malicious and accidental ways to attack routers that are not in the realm of what SIDR is considering now. Maliciousness is not the distinguisher here. To be plain, to say SIDR addresses only non-malicious cases is flat out WRONG. (And sorry for not having pointed that out before, I thought I did.) > The > idea is can we get a similar security with the current infrastructure, > by doing minor improvements. There is a certain cost involved with the > SIDR infrastructure. No, we cannot get similar security with current infrastructure, even with MAJOR improvements to the security of the current infrastructure. The structure of the current infrastructure does not permit similar security to what the RPKI provides. Unless, of course, you want to add all RPKI features to the IRR model, so that the IRR becomes the same as the RPKI. Of course, you adopt the cost as well. --Sandy > > I do not think the SSL channel has not been done because it is > unnecessary. I guess there hasn't been an attack on that side of the > infrastructure yet, but these are well known issues/ attacks in other > fields. > > Thanks, > Vishwas > _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Mar 5 22:07:26 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 02C8028C5E0; Wed, 5 Mar 2008 22:07:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -100.417 X-Spam-Level: X-Spam-Status: No, score=-100.417 tagged_above=-999 required=5 tests=[AWL=0.020, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id p0w93k26joQe; Wed, 5 Mar 2008 22:07:25 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0258C28C339; Wed, 5 Mar 2008 22:07:25 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 302273A6BB4; Wed, 5 Mar 2008 21:19:29 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ffOxhHrMkHg2; Wed, 5 Mar 2008 21:19:28 -0800 (PST) Received: from harbor.brookfield.occnc.com (unknown [69.37.59.172]) by core3.amsl.com (Postfix) with ESMTP id 1C2633A6889; Wed, 5 Mar 2008 21:18:37 -0800 (PST) Received: from harbor.brookfield.occnc.com (harbor.brookfield.occnc.com [69.37.59.172]) by harbor.brookfield.occnc.com (8.13.6/8.13.6) with ESMTP id m265IwVd002532; Thu, 6 Mar 2008 00:18:58 -0500 (EST) (envelope-from curtis@harbor.brookfield.occnc.com) Message-Id: <200803060518.m265IwVd002532@harbor.brookfield.occnc.com> To: Joe Abley From: Curtis Villamizar In-reply-to: Your message of "Tue, 04 Mar 2008 10:22:39 EST." <5B7F4259-8CAB-4895-8F26-8BFD0CE7C56B@ca.afilias.info> Date: Thu, 06 Mar 2008 00:18:58 -0500 X-Mailman-Approved-At: Wed, 05 Mar 2008 22:07:23 -0800 Cc: opsec wg mailing list , sidr@ietf.org Subject: Re: [OPSEC] [Sidr] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: curtis@occnc.com List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org In message <5B7F4259-8CAB-4895-8F26-8BFD0CE7C56B@ca.afilias.info> Joe Abley writes: > > > On 4-Mar-2008, at 10:14, Vishwas Manral wrote: > > > I was talking about the RIPE whois and other related tools that RIPE > > provides, when I looked at the link given below: > > http://www.ripe.net/news/study-youtube-hijacking.html > > > > As the tools cannot be accessed using https but using http, the tools > > cannot be used in a guaranteed fashion. We cannot build scripts over > > the tools and feel the information. > > I had no idea they were available over http. Everybody I know who uses > them uses whois. > > As to "cannot build", that doesn't seem to be an opinion shared by the > many ISPs who "have built". > > > Joe > _______________________________________________ > Sidr mailing list > Sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr http://www.ripe.net/db/support/update-reference-manual.pdf Read the abstract and you'll find out what is used for security. Its a bit old but it works. The query or update is in the clear (not encrypted) but can be authenticated with a signature over the contents. Curtis _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Mar 5 22:07:26 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DD14728C638; Wed, 5 Mar 2008 22:07:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -100.422 X-Spam-Level: X-Spam-Status: No, score=-100.422 tagged_above=-999 required=5 tests=[AWL=0.015, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9YsbzxmZAK7S; Wed, 5 Mar 2008 22:07:25 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2299028C47F; Wed, 5 Mar 2008 22:07:25 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B62383A6BB4; Wed, 5 Mar 2008 21:34:29 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 57RykufjhaGh; Wed, 5 Mar 2008 21:34:29 -0800 (PST) Received: from harbor.brookfield.occnc.com (unknown [69.37.59.172]) by core3.amsl.com (Postfix) with ESMTP id 7C19828C498; Wed, 5 Mar 2008 21:33:41 -0800 (PST) Received: from harbor.brookfield.occnc.com (harbor.brookfield.occnc.com [69.37.59.172]) by harbor.brookfield.occnc.com (8.13.6/8.13.6) with ESMTP id m265Y4To002722; Thu, 6 Mar 2008 00:34:04 -0500 (EST) (envelope-from curtis@harbor.brookfield.occnc.com) Message-Id: <200803060534.m265Y4To002722@harbor.brookfield.occnc.com> To: Sandra Murphy From: Curtis Villamizar In-reply-to: Your message of "Tue, 04 Mar 2008 11:34:18 EST." Date: Thu, 06 Mar 2008 00:34:04 -0500 X-Mailman-Approved-At: Wed, 05 Mar 2008 22:07:23 -0800 Cc: opsec wg mailing list , sidr@ietf.org Subject: Re: [OPSEC] [Sidr] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: curtis@occnc.com List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org In message Sandra Murphy writes: > > [---8<---snip---] > > > The > > idea is can we get a similar security with the current infrastructure, > > by doing minor improvements. There is a certain cost involved with the > > SIDR infrastructure. > > No, we cannot get similar security with current infrastructure, even with > MAJOR improvements to the security of the current infrastructure. The > structure of the current infrastructure does not permit similar security > to what the RPKI provides. > > Unless, of course, you want to add all RPKI features to the IRR model, so > that the IRR becomes the same as the RPKI. Of course, you adopt the cost > as well. > > --Sandy Sandy, Would you please enumerate those things that the IRR model does not support after reading RFC2725 and RFC2769. Note that RFC2769 has not been implemented but would provide the missing functionality (ability to authenticate information held in other registries). It also provides efficient replication of databases so anyone can have a local copy of any database of interest to improve query time. I am not advocating going in that direction, simply pointing out that SIDR to a large extent reinvents the wheel. If anything I think SIDR not implementing the full RPSL semantics is deficient. Curtis _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Mon Mar 10 08:51:01 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4080D3A7020; Mon, 10 Mar 2008 08:51:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.518 X-Spam-Level: X-Spam-Status: No, score=-101.518 tagged_above=-999 required=5 tests=[AWL=-1.081, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aDITX7zAW71w; Mon, 10 Mar 2008 08:51:00 -0700 (PDT) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 74C5B28CB69; Mon, 10 Mar 2008 08:29:16 -0700 (PDT) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 877C328C7CF for ; Mon, 10 Mar 2008 08:29:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id o99tFeAXF-vP for ; Mon, 10 Mar 2008 08:29:11 -0700 (PDT) Received: from nagasaki.bogus.com (nagasaki.bogus.com [IPv6:2001:418:1::81]) by core3.amsl.com (Postfix) with ESMTP id B439028DC8A for ; Mon, 10 Mar 2008 08:05:39 -0700 (PDT) Received: from [130.129.23.244] (dhcp-17f4.ietf71.ietf.org [130.129.23.244]) (authenticated bits=0) by nagasaki.bogus.com (8.14.1/8.13.8) with ESMTP id m2AF3Gp1057216 for ; Mon, 10 Mar 2008 15:03:17 GMT (envelope-from joelja@bogus.com) Message-ID: <47D54DB3.5000705@bogus.com> Date: Mon, 10 Mar 2008 08:03:15 -0700 From: Joel Jaeggli User-Agent: Thunderbird 2.0.0.12 (X11/20080226) MIME-Version: 1.0 To: opsec wg mailing list X-Enigmail-Version: 0.95.6 X-Virus-Scanned: ClamAV 0.92.1/6191/Mon Mar 10 10:45:33 2008 on nagasaki.bogus.com X-Virus-Status: Clean Subject: [OPSEC] OPSEC lunch... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org I am proposing the fieldhouse located one block from the hotel at: 150 Filbert Street "the reading terminal building" meet in the lobby of the Marriot at: 11:40 tuesday march 11... _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Mon Mar 10 09:47:00 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3F99A28C67C; Mon, 10 Mar 2008 09:47:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -100.436 X-Spam-Level: X-Spam-Status: No, score=-100.436 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, HTML_MESSAGE=0.001, RDNS_NONE=0.1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1eThrX3dwYq0; Mon, 10 Mar 2008 09:47:00 -0700 (PDT) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4477C3A6C0F; Mon, 10 Mar 2008 09:27:52 -0700 (PDT) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1DA0C3A68B9; Sun, 9 Mar 2008 19:45:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sAHUVzEiNyaA; Sun, 9 Mar 2008 19:44:58 -0700 (PDT) Received: from mx11.bbn.com (mx11.bbn.com [128.33.0.80]) by core3.amsl.com (Postfix) with ESMTP id 4266A3A686D; Sun, 9 Mar 2008 19:44:58 -0700 (PDT) Received: from dommiel.bbn.com ([192.1.122.15] helo=[10.150.134.25]) by mx11.bbn.com with esmtp (Exim 4.60) (envelope-from ) id 1JYXyG-0001PT-5m; Sun, 09 Mar 2008 22:42:36 -0400 Mime-Version: 1.0 Message-Id: In-Reply-To: <200803060534.m265Y4To002722@harbor.brookfield.occnc.com> References: <200803060534.m265Y4To002722@harbor.brookfield.occnc.com> Date: Sun, 9 Mar 2008 22:42:45 -0400 To: curtis@occnc.com From: Stephen Kent X-Mailman-Approved-At: Mon, 10 Mar 2008 09:27:50 -0700 Cc: opsec wg mailing list , Sandra Murphy , sidr@ietf.org Subject: Re: [OPSEC] [Sidr] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0537802570==" Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org --===============0537802570== Content-Type: multipart/alternative; boundary="============_-1007005529==_ma============" --============_-1007005529==_ma============ Content-Type: text/plain; charset="us-ascii" ; format="flowed" At 12:34 AM -0500 3/6/08, Curtis Villamizar wrote: >I... > > >Sandy, > >Would you please enumerate those things that the IRR model does not >support after reading RFC2725 and RFC2769. > >Note that RFC2769 has not been implemented but would provide the >missing functionality (ability to authenticate information held in >other registries). It also provides efficient replication of >databases so anyone can have a local copy of any database of interest >to improve query time. > >I am not advocating going in that direction, simply pointing out that >SIDR to a large extent reinvents the wheel. If anything I think SIDR >not implementing the full RPSL semantics is deficient. > >Curtis Curtis, My impression was that 2769 does not address the same set of concerns that the RPKI work is addressing. The RPKI provides a strong, cert-based link between the resource allocation hierarchy and signed objects that attest to resource holdings. The use of ROAs and analogous signed objects (verifiable under the RPKI) enable resource holders to make clearly defined assertions about resources, e.g, the authorization of an AS to originate a route to a prefix. These assertions can be verified without worrying about the integrity of the management of an IRR, e.g., the path via which the object was obtained. 2769 seems to focus on authorization to manage objects in the IRR, a very important but distinct concern. The integrity model seems to emphasize transitive trust (e.g., tracing data integrity back to an authoritative directory), and authorization of manage an object. This is different from the use of signed objects that can be verified through use of an authoritative PKI. (I note that the term PKI does not appear anywhere in the RFC, and the term certificate (or cert) appears only a few times. There are references to use of PGP keys for authenticating a user who wants to manage objects, but that is a very different use of public key crypto.) It is appropriate to examine the intersection of the IRR/RPSL model and the SIDR work to see how the two can fit together, but I disagree with the suggestion that SIDR "reinvents the wheel." SIDR adopts a different initial focus, i.e., defining a profile for certs that represent resource holdings. As we move to introduce additional signed objects, e.g. ROAs and BOAs, then we get closer to some of the functionality of RPSL. Steve --============_-1007005529==_ma============ Content-Type: text/html; charset="us-ascii" Re: [Sidr] [OPSEC] pccw as17557 leak...
At 12:34 AM -0500 3/6/08, Curtis Villamizar wrote:
I...


Sandy,

Would you please enumerate those things that the IRR model does not
support after reading RFC2725 and RFC2769.
Note that RFC2769 has not been implemented but would provide the
missing functionality (ability to authenticate information held in
other registries).  It also provides efficient replication of
databases so anyone can have a local copy of any database of interest
to improve query time.

I am not advocating going in that direction, simply pointing out that
SIDR to a large extent reinvents the wheel.  If anything I think SIDR
not implementing the full RPSL semantics is deficient.
Curtis

Curtis,

My impression was that 2769 does not address the same set of concerns that the RPKI work is addressing.

The RPKI provides a strong, cert-based link between the resource allocation hierarchy and signed objects that attest to resource holdings. The use of ROAs and analogous signed objects (verifiable under the RPKI) enable resource holders to make clearly defined assertions about resources, e.g, the authorization of an AS to originate a route to a prefix. These assertions can be verified without worrying about the integrity of the management of an IRR, e.g., the path via which the object was obtained.

2769 seems to focus on authorization to manage objects in the IRR, a very important but distinct concern.  The integrity model seems to emphasize transitive trust (e.g., tracing data integrity back to an authoritative directory), and authorization of manage an object. This is different from the use of signed objects that can be verified through use of an authoritative PKI. (I note that the term PKI does not appear anywhere in the RFC, and the term certificate (or cert) appears only a few times. There are references to use of PGP keys for authenticating a user who wants to manage objects, but that is a very different use of public key crypto.)

It is appropriate to examine the intersection of the IRR/RPSL model and the SIDR work to see how the two can fit together, but I disagree with the suggestion that SIDR "reinvents the wheel." SIDR adopts a different initial focus, i.e., defining a profile for certs that represent resource holdings. As we move to introduce additional signed objects, e.g. ROAs and BOAs, then  we get closer to some of the functionality of RPSL.

Steve
--============_-1007005529==_ma============-- --===============0537802570== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec --===============0537802570==-- From opsec-bounces@ietf.org Mon Mar 10 12:54:17 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 720043A6CC4; Mon, 10 Mar 2008 12:54:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -100.515 X-Spam-Level: X-Spam-Status: No, score=-100.515 tagged_above=-999 required=5 tests=[AWL=-0.078, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pym7Zwuk8574; Mon, 10 Mar 2008 12:54:16 -0700 (PDT) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AB4A93A6B87; Mon, 10 Mar 2008 12:54:16 -0700 (PDT) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 240173A68E5; Mon, 10 Mar 2008 12:51:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id maBGaWNc38Ay; Mon, 10 Mar 2008 12:51:39 -0700 (PDT) Received: from manos.scc.mi.org (manos.scc.mi.org [204.11.140.250]) by core3.amsl.com (Postfix) with ESMTP id 681913A68C6; Mon, 10 Mar 2008 12:51:39 -0700 (PDT) Received: by manos.scc.mi.org (Postfix, from userid 1025) id 52C824E4B0; Mon, 10 Mar 2008 15:49:19 -0400 (EDT) Date: Mon, 10 Mar 2008 15:49:19 -0400 From: Jeffrey Haas To: Sandra Murphy Message-ID: <20080310194919.GA22820@scc.mi.org> References: <77ead0ec0802271712m53e8a1d4sc9cae09ee75686f7@mail.gmail.com> <77ead0ec0802271913u2c032ec2y2d03b73cb36de37f@mail.gmail.com> <77ead0ec0802272031j6d958279tf3028c4096093020@mail.gmail.com> <77ead0ec0802280649k66671fc9s9fc24314963c68a0@mail.gmail.com> <77ead0ec0802280956s3dcff81cx25fd152ea1c798fb@mail.gmail.com> Mime-Version: 1.0 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.9i X-Mailman-Approved-At: Mon, 10 Mar 2008 12:54:15 -0700 Cc: opsec wg mailing list , sidr@ietf.org Subject: Re: [OPSEC] [Sidr] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org On Thu, Feb 28, 2008 at 01:34:49PM -0500, Sandra Murphy wrote: > When I say origination of route advertisements, I am not talking about the > ORIGIN attribute in the BGP Update. I'd suggest refering to this as the originating AS. -- Jeff _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Mon Mar 10 14:07:09 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 97AD128C53B; Mon, 10 Mar 2008 14:07:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -100.707 X-Spam-Level: X-Spam-Status: No, score=-100.707 tagged_above=-999 required=5 tests=[AWL=-0.270, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jbaPwmfWbjwb; Mon, 10 Mar 2008 14:07:07 -0700 (PDT) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C9E5C28C4BC; Mon, 10 Mar 2008 14:06:05 -0700 (PDT) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3A7DA3A6DD0; Mon, 10 Mar 2008 13:55:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id b5Hx2Vd21P8o; Mon, 10 Mar 2008 13:55:04 -0700 (PDT) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by core3.amsl.com (Postfix) with ESMTP id F0FF53A6D4D; Mon, 10 Mar 2008 13:55:03 -0700 (PDT) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.13.5/8.13.5) with ESMTP id m2AKqgwL032415; Mon, 10 Mar 2008 15:52:42 -0500 Received: from nemo.columbia.ads.sparta.com (nemo.columbia.sparta.com [157.185.80.75]) by Beta5.sparta.com (8.12.11/8.13.1) with ESMTP id m2AKqgPx021522; Mon, 10 Mar 2008 15:52:42 -0500 Received: from localhost ([130.129.20.112]) by nemo.columbia.ads.sparta.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.3959); Mon, 10 Mar 2008 16:52:41 -0400 Date: Mon, 10 Mar 2008 16:52:41 -0400 (Eastern Daylight Time) From: Sandra Murphy To: Curtis Villamizar In-Reply-To: <200803060534.m265Y4To002722@harbor.brookfield.occnc.com> Message-ID: References: <200803060534.m265Y4To002722@harbor.brookfield.occnc.com> X-X-Sender: sandy@nemo.columbia.sparta.com MIME-Version: 1.0 X-OriginalArrivalTime: 10 Mar 2008 20:52:41.0703 (UTC) FILETIME=[AED53770:01C882F0] X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-3.0 (M4.sparta.com [157.185.61.2]); Mon, 10 Mar 2008 15:52:42 -0500 (CDT) X-Mailman-Approved-At: Mon, 10 Mar 2008 14:06:05 -0700 Cc: opsec wg mailing list , sidr@ietf.org Subject: Re: [OPSEC] [Sidr] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org On Thu, 6 Mar 2008, Curtis Villamizar wrote: > > In message > Sandra Murphy writes: >> >> [---8<---snip---] >> << snip >> > > Sandy, > > Would you please enumerate those things that the IRR model does not > support after reading RFC2725 and RFC2769. > > Note that RFC2769 has not been implemented but would provide the > missing functionality (ability to authenticate information held in > other registries). It also provides efficient replication of > databases so anyone can have a local copy of any database of interest > to improve query time. > > I am not advocating going in that direction, simply pointing out that > SIDR to a large extent reinvents the wheel. If anything I think SIDR > not implementing the full RPSL semantics is deficient. > > Curtis > I commented last July on the security model (RPSS) used in RIPE http://www.ietf.org/mail-archive/web/sidr/current/msg00207.html To expand a bit. The model in RPSS has a similar basis as the model used in the RPKI, namely that delegation of a prefix requires authority over a covering prefix - that comes from the inetnum authorization requirement. The RPSS model also insists that the prefix holder is the one who authorizes origination of routes to that prefix. The RPSS model goes further to insist that authorization to originate routes (actually, to create a route object for a prefix) must also be granted by the AS mentioned. In that the authorization model in RPSS is different than the RPKI model. That makes revoking authorization different as well. To delte a route object in RPSS, you need the authorization of both the prefix holder and the AS. (This could cause difficulties if some prefix holder changes providers and wishes to remove the route object, if its former provider is not interested in OK the route object deletion.) RFC2769 addresses the problem (I think) of invalidating inetnums that are derived from an inetnet that gets deleted. (If that is what is meant as "repeating authorization checks".) It seems to me that there is no way to bound the number of database objects that are potentially effected by one object deletion. But the biggest difference is in the trust model. RPSS assumes that the IRR has a way to authenticate the principles - the maintainers. A particular object might have multiple maintainers (of various types) and each can have more than one way to be authenticated. The maintainers authenticate in some way to the IRR and the IRR stores the data. Those referring to the data must have some way to retrieve the data from the IRR that is itself secure. But even with a secure retrieval, the data retrieved carries no hint of the authentication with which it was transmitted to the IRR. You don't know which maintainer placed the info there and you don't know what authentication mechanism was used in accepting the data. No one can authenticate the data except the IRR, and no one can know what assurance to place in the data, aside from a blind "I trust my IRR". There are also issues of staleness of data, as there is no mechanism to state and enforce a validity period. (From reports, stale IRR data played a part in the spread of bogus info in the Con Ed incident last year.) An IRR might go to using the strongest authentication possible, and to accepting signed data and storing the signature. And publishing the certs it assigned to users. That would go pretty far to giving the same assurance of the RPKI. But that's kind of what I meant about adopting the same mechanisms as the RPKI, and therefore the cost --Sandy. _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Tue Mar 25 22:36:15 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 91C2F28C3C8; Tue, 25 Mar 2008 22:36:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -100.677 X-Spam-Level: X-Spam-Status: No, score=-100.677 tagged_above=-999 required=5 tests=[AWL=-0.240, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HgQupP3OJR5Z; Tue, 25 Mar 2008 22:36:14 -0700 (PDT) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A905728C26C; Tue, 25 Mar 2008 22:36:14 -0700 (PDT) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4E92628C26C for ; Tue, 25 Mar 2008 22:36:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id e1dMOpcgEl+e for ; Tue, 25 Mar 2008 22:36:12 -0700 (PDT) Received: from nagasaki.bogus.com (nagasaki.bogus.com [IPv6:2001:418:1::81]) by core3.amsl.com (Postfix) with ESMTP id 4426228C25C for ; Tue, 25 Mar 2008 22:36:12 -0700 (PDT) Received: from [192.168.11.103] (c-67-164-68-173.hsd1.ca.comcast.net [67.164.68.173]) (authenticated bits=0) by nagasaki.bogus.com (8.14.1/8.13.8) with ESMTP id m2Q5XnS9068456; Wed, 26 Mar 2008 05:33:49 GMT (envelope-from joelja@bogus.com) Message-ID: <47E9E03C.70909@bogus.com> Date: Tue, 25 Mar 2008 22:33:48 -0700 From: Joel Jaeggli User-Agent: Thunderbird 2.0.0.12 (X11/20080226) MIME-Version: 1.0 To: opsec wg mailing list X-Enigmail-Version: 0.95.6 X-Virus-Scanned: ClamAV 0.92.1/6392/Tue Mar 25 12:44:02 2008 on nagasaki.bogus.com X-Virus-Status: Clean Subject: [OPSEC] Notes from IETF... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org During IETF 71 I had an opportunity to meet with our illustrious ADs and whomever I could gather from the mailing list, I have a couple of notes. Outstanding Documents - It was proffered that we should clear the dormant or dead documents from the iesg queue with the exception of: draft-ietf-opsec-filter-caps Which we belive can be rehabilited in the near term. That means these docs (I hope Ron will correct me if I missed any) are on the chopping block. draft-ietf-opsec-framework draft-ietf-opsec-logging-caps draft-ietf-opsec-routing-capabilities With that, the work that started with 3871 will be done, even if it's not finished. Anyone who has thoughts on this should chime in. Work items - The next order order of business is getting some new work items accepted under our proposed charter. There has not been much movement of late on the ICMP filtering and rate limiting discussion so we probably want to refresh our understanding of where that document is an get something submitted by May. I haven't gotten any updates on other action items since prior to IETF though I will make it a priority to follow-up New Work Items - Danny Mcpherson has been working on an document aimed at routing policy basics in light of some of the highly publicized events of late (not that they don't happen all the time, however it is timely since attention has directed concern in the appropriate places) that might be well aligned with this working group if he'll put up with us. ;) Related IETF activities - I have been watching SIDR with some degree of interest. It remains to be seen in my opinion when the pain associated with securing routing announcements is lower than the pain associated with not doing it. When I look at the security "hacks"that have been successfully deployed in support of the routing system, things like the ttl hack or tcp MD5 the benefits were immediately available with incremental deployment, obviously they were aimed at securing the communications not the contents. Can we reap benefits from incremental SIDR deployment that are sufficiently compelling to negate the pain points? Those are the thoughts that I've collected post-IETF, thanks for your indulgence. joelja _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Mar 26 23:47:57 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 058DC3A6AA0; Wed, 26 Mar 2008 23:47:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -100.471 X-Spam-Level: X-Spam-Status: No, score=-100.471 tagged_above=-999 required=5 tests=[AWL=-0.034, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TJMAFjqr5kvP; Wed, 26 Mar 2008 23:47:56 -0700 (PDT) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AAF8628C38D; Wed, 26 Mar 2008 23:47:55 -0700 (PDT) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9D5343A6A89 for ; Wed, 26 Mar 2008 23:47:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LcnaNmNZ+ArW for ; Wed, 26 Mar 2008 23:47:49 -0700 (PDT) Received: from netcore.fi (eunet-gw.ipv6.netcore.fi [IPv6:2001:670:86:3001::1]) by core3.amsl.com (Postfix) with ESMTP id 2EB033A6959 for ; Wed, 26 Mar 2008 23:47:48 -0700 (PDT) Received: from netcore.fi (localhost [127.0.0.1]) by netcore.fi (8.13.8/8.13.8) with ESMTP id m2R6jJqU010292; Thu, 27 Mar 2008 08:45:19 +0200 Received: from localhost (pekkas@localhost) by netcore.fi (8.13.8/8.13.8/Submit) with ESMTP id m2R6jIe9010289; Thu, 27 Mar 2008 08:45:19 +0200 Date: Thu, 27 Mar 2008 08:45:18 +0200 (EET) From: Pekka Savola To: Joel Jaeggli In-Reply-To: <47E9E03C.70909@bogus.com> Message-ID: References: <47E9E03C.70909@bogus.com> User-Agent: Alpine 1.10 (LRH 962 2008-03-14) MIME-Version: 1.0 X-Virus-Scanned: ClamAV 0.92.1/6415/Thu Mar 27 02:30:08 2008 on otso.netcore.fi X-Virus-Status: Clean Cc: opsec wg mailing list Subject: Re: [OPSEC] Notes from IETF... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org On Tue, 25 Mar 2008, Joel Jaeggli wrote: > Outstanding Documents - > It was proffered that we should clear the dormant or dead documents from > the iesg queue with the exception of: > > draft-ietf-opsec-filter-caps > > Which we belive can be rehabilited in the near term. > > That means these docs (I hope Ron will correct me if I missed any) are > on the chopping block. > > draft-ietf-opsec-framework > draft-ietf-opsec-logging-caps > draft-ietf-opsec-routing-capabilities > > With that, the work that started with 3871 will be done, even if it's > not finished. Anyone who has thoughts on this should chime in. draft-ietf-opsec-infrastructure-security also expired. Which category should that go? draft-ietf-opsec-efforts has not expired yet, which category is that? Could you elaborate a bit on the reasons for this chopping? If there was an explanation before, I have missed it. > New Work Items - Some folks have expressed interest in me pursuing http://tools.ietf.org/html/draft-savola-rtgwg-backbone-attacks-03 in some forum. It's not obvious to me whether this is generic enough to be published as an RFC and/or to be taken up as a WG work item. I'd welcome comments on this point, on- or off-list. -- Pekka Savola "You each name yourselves king, yet the Netcore Oy kingdom bleeds." Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Sun Mar 30 15:49:02 2008 Return-Path: X-Original-To: opsec-archive@optimus.ietf.org Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id ECD3928C379; Sun, 30 Mar 2008 15:49:01 -0700 (PDT) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 440A728C379 for ; Sun, 30 Mar 2008 15:49:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.266 X-Spam-Level: ** X-Spam-Status: No, score=2.266 tagged_above=-999 required=5 tests=[BAYES_40=-0.185, RCVD_IN_NJABL_PROXY=1.643, SARE_RECV_SPEEDY_AR=0.808] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id b694tvbiqLa9 for ; Sun, 30 Mar 2008 15:49:00 -0700 (PDT) Received: from smtp1.xmundo.net (smtp1.xmundo.net [201.216.232.80]) by core3.amsl.com (Postfix) with ESMTP id ECB7628C275 for ; Sun, 30 Mar 2008 15:48:58 -0700 (PDT) Received: from venus.xmundo.net (venus.xmundo.net [201.216.232.56]) by smtp1.xmundo.net (Postfix) with ESMTP id 062825A7DE3 for ; Sun, 30 Mar 2008 19:49:00 -0300 (ART) Received: from notebook.gont.com.ar (201-254-61-208.speedy.com.ar [201.254.61.208] (may be forged)) (authenticated bits=0) by venus.xmundo.net (8.13.8/8.13.8) with ESMTP id m2UMmhSn014472 for ; Sun, 30 Mar 2008 19:48:45 -0300 Message-Id: <200803302248.m2UMmhSn014472@venus.xmundo.net> X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Sun, 30 Mar 2008 19:46:55 -0300 To: opsec wg mailing list From: Fernando Gont Mime-Version: 1.0 X-Greylist: Sender succeeded SMTP AUTH authentication, not delayed by milter-greylist-3.0 (venus.xmundo.net [201.216.232.56]); Sun, 30 Mar 2008 19:48:56 -0300 (ART) Subject: [OPSEC] New I-D on ICMP filtering X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org Folks, After quite some time of discussing this subject on the list, we have finally published a (very drafty) internet draft on ICMP filtering. Our draft borrows its structure from the wiki George Jones had started on the subject. We have spent an extraordinary amount of time digging into the specs, in the hope of being able to include pointers to the relevant RFCs where each of the ICMP messages are defined (part of this work should be credited to Carlos Pignataro). So far, we have included all this information in our draft, and have already started populating the "uses", "security threats" and "Operational implications if blocked" subsections corresponding to each of the ICMP messages. We'd like to receive feedback on the structure of the draft. That is, whether you are happy with the current structure of the draft (so that we continue moving in this direction), or whether some changes would be needed for you to feel happier about it. Among the possible changes could be: * Discuss request/response messages in the same section, rather than having subsections for each of them. I think the current structure (having a subsection for each type/code) is good, but... * Changing the structure of the draft actually, the xml tag in the xml source) so that "Uses", "Threats" and "Operational/interoperability impact if blocked" are NOT "sections". This would avoid section numbers having a fifth level of nesting (e.g., 1.2.3.4.5)... but might be good for referencing a specific part of this draft. Any other comments are welcome. The draft is available at the ID repository, but we have also put it online (and in different fancy formats) at: http://www.gont.com.ar/drafts/icmp-filtering/index.html Thanks! Kind regards, -- Fernando Gont e-mail: fernando@gont.com.ar || fgont@acm.org PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1 _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Sun Mar 30 17:35:52 2008 Return-Path: X-Original-To: opsec-archive@optimus.ietf.org Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C1B0728C33B; Sun, 30 Mar 2008 17:35:52 -0700 (PDT) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B2BF728C33B for ; Sun, 30 Mar 2008 17:35:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id I8JhNAJlu8XN for ; Sun, 30 Mar 2008 17:35:50 -0700 (PDT) Received: from nagasaki.bogus.com (nagasaki.bogus.com [IPv6:2001:418:1::81]) by core3.amsl.com (Postfix) with ESMTP id 97AFA28C16A for ; Sun, 30 Mar 2008 17:35:50 -0700 (PDT) Received: from [192.103.16.227] ([192.103.16.227]) (authenticated bits=0) by nagasaki.bogus.com (8.14.1/8.13.8) with ESMTP id m2V0ZkJF074971; Mon, 31 Mar 2008 00:35:47 GMT (envelope-from joelja@bogus.com) Message-ID: <47F031D2.1090603@bogus.com> Date: Sun, 30 Mar 2008 17:35:30 -0700 From: Joel Jaeggli User-Agent: Thunderbird 2.0.0.12 (X11/20080226) MIME-Version: 1.0 To: Pekka Savola References: <47E9E03C.70909@bogus.com> In-Reply-To: X-Enigmail-Version: 0.95.6 X-Virus-Scanned: ClamAV 0.92.1/6488/Sun Mar 30 23:29:21 2008 on nagasaki.bogus.com X-Virus-Status: Clean Cc: opsec wg mailing list Subject: Re: [OPSEC] Notes from IETF... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org Pekka Savola wrote: > On Tue, 25 Mar 2008, Joel Jaeggli wrote: >> Outstanding Documents - >> It was proffered that we should clear the dormant or dead documents from >> the iesg queue with the exception of: >> >> draft-ietf-opsec-filter-caps >> >> Which we belive can be rehabilited in the near term. >> >> That means these docs (I hope Ron will correct me if I missed any) are >> on the chopping block. >> >> draft-ietf-opsec-framework >> draft-ietf-opsec-logging-caps >> draft-ietf-opsec-routing-capabilities >> >> With that, the work that started with 3871 will be done, even if it's >> not finished. Anyone who has thoughts on this should chime in. > > draft-ietf-opsec-infrastructure-security also expired. Which category > should that go? It apparently escaped my noticed. I believe that it should be removed from queue. I am willing to entertain alternate actions if someone would care to speak up in it's defense or of the others for that matter. > draft-ietf-opsec-efforts has not expired yet, which > category is that? The opsec efforts draft doesn't expire till june. I would observe that this documents utility is principally related to the frequency of it's update since much of the information it contains becomes stale over time (this is just my opinion, someone correct me if I'm wrong). For this reason we did not (I think) envision it falling off the truck. > Could you elaborate a bit on the reasons for this chopping? If there > was an explanation before, I have missed it. To clear the queue of moribund items. If we're not going to advance something there's little use in leaving it around in the dead state. >> New Work Items - > > Some folks have expressed interest in me pursuing > http://tools.ietf.org/html/draft-savola-rtgwg-backbone-attacks-03 in > some forum. It's not obvious to me whether this is generic enough to be > published as an RFC and/or to be taken up as a WG work item. I'd welcome > comments on this point, on- or off-list. I believe that it would be within scope of this working group to have that as a work item. Other opinions would be appreciated... _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Sun Mar 30 23:17:33 2008 Return-Path: X-Original-To: opsec-archive@optimus.ietf.org Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2041E3A6C86; Sun, 30 Mar 2008 23:17:33 -0700 (PDT) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 130A63A6B4F for ; Sun, 30 Mar 2008 23:17:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id J8RzOxOUrHIe for ; Sun, 30 Mar 2008 23:17:31 -0700 (PDT) Received: from netcore.fi (eunet-gw.ipv6.netcore.fi [IPv6:2001:670:86:3001::1]) by core3.amsl.com (Postfix) with ESMTP id ECCF73A69F7 for ; Sun, 30 Mar 2008 23:17:30 -0700 (PDT) Received: from netcore.fi (localhost [127.0.0.1]) by netcore.fi (8.13.8/8.13.8) with ESMTP id m2V6H4lZ012599; Mon, 31 Mar 2008 09:17:04 +0300 Received: from localhost (pekkas@localhost) by netcore.fi (8.13.8/8.13.8/Submit) with ESMTP id m2V6H3dp012595; Mon, 31 Mar 2008 09:17:04 +0300 Date: Mon, 31 Mar 2008 09:17:03 +0300 (EEST) From: Pekka Savola To: Fernando Gont In-Reply-To: <200803302248.m2UMmhSn014472@venus.xmundo.net> Message-ID: References: <200803302248.m2UMmhSn014472@venus.xmundo.net> User-Agent: Alpine 1.10 (LRH 962 2008-03-14) MIME-Version: 1.0 X-Virus-Scanned: ClamAV 0.92.1/6472/Sun Mar 30 04:12:23 2008 on otso.netcore.fi X-Virus-Status: Clean Cc: opsec wg mailing list Subject: Re: [OPSEC] New I-D on ICMP filtering X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org On Sun, 30 Mar 2008, Fernando Gont wrote: > We'd like to receive feedback on the structure of the draft. That is, > whether you are happy with the current structure of the draft (so > that we continue moving in this direction), or whether some changes > would be needed for you to feel happier about it. Among the possible > changes could be: I was not involved in the discussions that led to this I-D, so I may be missing something. This format would be great for reference documentation (e.g. as an addon to RFC791/1122/1812 and various ICMP specs) as an int-area project. It seems somewhat verbose from the OPsec point of view. If the document length exceeds 15-20 pages, it's too long to be considered as a useful recommendation. Maybe we can put a "summary" section in front which would be 2 pages and the rest of the document would be 30 or 40 pages but not sure whether opsec is the right place to develop this kind of doc. From the OPsec perspective, I'd have thought that the most useful output would be generated by starting by trying to develop consensus on filtering practices, describe the tradeoffs when consensus does not emerge and draw in support/analysis from specifications only as necessary (rather than start from the specifications). -- Pekka Savola "You each name yourselves king, yet the Netcore Oy kingdom bleeds." Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Mon Mar 31 04:22:21 2008 Return-Path: X-Original-To: opsec-archive@optimus.ietf.org Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 090FB3A6A7C; Mon, 31 Mar 2008 04:22:21 -0700 (PDT) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 40D363A6814 for ; Mon, 31 Mar 2008 04:22:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zfdhAUm0ndtE for ; Mon, 31 Mar 2008 04:22:19 -0700 (PDT) Received: from smtp-bedford.mitre.org (smtp-bedford.mitre.org [129.83.20.191]) by core3.amsl.com (Postfix) with ESMTP id 5E58D28C1E8 for ; Mon, 31 Mar 2008 04:22:19 -0700 (PDT) Received: from smtp-bedford.mitre.org (localhost.localdomain [127.0.0.1]) by smtp-bedford.mitre.org (8.13.1/8.13.1) with ESMTP id m2VBMGCR029310 for ; Mon, 31 Mar 2008 07:22:17 -0400 Received: from IMCFE1.MITRE.ORG (imcfe1.mitre.org [129.83.29.3]) by smtp-bedford.mitre.org (8.13.1/8.13.1) with ESMTP id m2VBMGUv029301; Mon, 31 Mar 2008 07:22:16 -0400 Received: from [127.0.0.1] ([129.83.10.1]) by IMCFE1.MITRE.ORG with Microsoft SMTPSVC(6.0.3790.1830); Mon, 31 Mar 2008 07:22:16 -0400 Message-ID: <47F0CB3B.5090506@mitre.org> Date: Mon, 31 Mar 2008 07:30:03 -0400 From: George M Jones User-Agent: Thunderbird 2.0.0.12 (X11/20080227) MIME-Version: 1.0 To: Fernando Gont References: <200803302248.m2UMmhSn014472@venus.xmundo.net> In-Reply-To: <200803302248.m2UMmhSn014472@venus.xmundo.net> X-OriginalArrivalTime: 31 Mar 2008 11:22:16.0331 (UTC) FILETIME=[7998A5B0:01C89321] Cc: opsec wg mailing list Subject: Re: [OPSEC] New I-D on ICMP filtering X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org Looks like a good start. Only issue is length. Does it need to restate the existing specs in such detail ? Would it be possible to have a summary table or something at the front ? ---George Jones _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Mon Mar 31 04:25:10 2008 Return-Path: X-Original-To: opsec-archive@optimus.ietf.org Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 707363A6DAF; Mon, 31 Mar 2008 04:25:10 -0700 (PDT) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B6E313A6D73 for ; Mon, 31 Mar 2008 04:25:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NBM6qw0bKVmM for ; Mon, 31 Mar 2008 04:25:08 -0700 (PDT) Received: from smtp-bedford.mitre.org (smtp-bedford.mitre.org [129.83.20.191]) by core3.amsl.com (Postfix) with ESMTP id CED123A6BD6 for ; Mon, 31 Mar 2008 04:25:07 -0700 (PDT) Received: from smtp-bedford.mitre.org (localhost.localdomain [127.0.0.1]) by smtp-bedford.mitre.org (8.13.1/8.13.1) with ESMTP id m2VBP549004178 for ; Mon, 31 Mar 2008 07:25:05 -0400 Received: from IMCFE1.MITRE.ORG (imcfe1.mitre.org [129.83.29.3]) by smtp-bedford.mitre.org (8.13.1/8.13.1) with ESMTP id m2VBP5l5004170; Mon, 31 Mar 2008 07:25:05 -0400 Received: from [127.0.0.1] ([129.83.10.1]) by IMCFE1.MITRE.ORG with Microsoft SMTPSVC(6.0.3790.1830); Mon, 31 Mar 2008 07:25:04 -0400 Message-ID: <47F0CBE4.8020603@mitre.org> Date: Mon, 31 Mar 2008 07:32:52 -0400 From: George M Jones User-Agent: Thunderbird 2.0.0.12 (X11/20080227) MIME-Version: 1.0 To: Joel Jaeggli References: <47E9E03C.70909@bogus.com> <47F031D2.1090603@bogus.com> In-Reply-To: <47F031D2.1090603@bogus.com> X-OriginalArrivalTime: 31 Mar 2008 11:25:04.0860 (UTC) FILETIME=[DE0C21C0:01C89321] Cc: opsec wg mailing list Subject: Re: [OPSEC] Notes from IETF... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org Joel Jaeggli wrote: > > he dead state. > > >> New Work Items - > > > > Some folks have expressed interest in me pursuing > > http://tools.ietf.org/html/draft-savola-rtgwg-backbone-attacks-03 in > > some forum. It's not obvious to me whether this is generic enough to be > > published as an RFC and/or to be taken up as a WG work item. I'd welcome > > comments on this point, on- or off-list. > > I believe that it would be within scope of this working group to have > that as a work item. Other opinions would be appreciated... > I thought, and think that it is a good document and should be in scope. ---George _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Mon Mar 31 04:36:26 2008 Return-Path: X-Original-To: opsec-archive@optimus.ietf.org Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CE9B83A6B88; Mon, 31 Mar 2008 04:36:26 -0700 (PDT) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 863C63A6B88 for ; Mon, 31 Mar 2008 04:36:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.734 X-Spam-Level: X-Spam-Status: No, score=-1.734 tagged_above=-999 required=5 tests=[AWL=0.865, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cjZwnCPs2hjD for ; Mon, 31 Mar 2008 04:36:19 -0700 (PDT) Received: from de307622-de-outbound.net.avaya.com (de307622-de-outbound.net.avaya.com [198.152.71.100]) by core3.amsl.com (Postfix) with ESMTP id A090828C3E0 for ; Mon, 31 Mar 2008 04:35:49 -0700 (PDT) X-IronPort-AV: E=Sophos;i="4.25,582,1199682000"; d="scan'208";a="100294015" Received: from unknown (HELO co300216-co-erhwest.avaya.com) ([198.152.7.5]) by de307622-de-outbound.net.avaya.com with ESMTP; 31 Mar 2008 07:35:38 -0400 X-IronPort-AV: E=Sophos;i="4.25,582,1199682000"; d="scan'208";a="182352637" Received: from unknown (HELO 307622ANEX5.global.avaya.com) ([135.64.140.13]) by co300216-co-erhwest-out.avaya.com with ESMTP; 31 Mar 2008 07:35:37 -0400 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Date: Mon, 31 Mar 2008 13:35:44 +0200 Message-ID: In-Reply-To: <47F0CBE4.8020603@mitre.org> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [OPSEC] Notes from IETF... Thread-Index: AciTIgp9GSyvMCMZQwC084kJrB/TJgAATReQ References: <47E9E03C.70909@bogus.com><47F031D2.1090603@bogus.com> <47F0CBE4.8020603@mitre.org> From: "Romascanu, Dan (Dan)" To: "George M Jones" , "Joel Jaeggli" Cc: opsec wg mailing list Subject: Re: [OPSEC] Notes from IETF... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org > -----Original Message----- > From: opsec-bounces@ietf.org [mailto:opsec-bounces@ietf.org] > On Behalf Of George M Jones > Sent: Monday, March 31, 2008 2:33 PM > To: Joel Jaeggli > Cc: opsec wg mailing list > Subject: Re: [OPSEC] Notes from IETF... > > Joel Jaeggli wrote: > > > > he dead state. > > > > >> New Work Items - > > > > > > Some folks have expressed interest in me pursuing > > > > http://tools.ietf.org/html/draft-savola-rtgwg-backbone-attacks-03 in > > > some forum. It's not obvious to me whether this is > generic enough > > > to be published as an RFC and/or to be taken up as a WG > work item. > > > I'd welcome comments on this point, on- or off-list. > > > > I believe that it would be within scope of this working > group to have > > that as a work item. Other opinions would be appreciated... > > > > I thought, and think that it is a good document and should be > in scope. > > ---George I agree. Dan (speaking as a contributor) _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Mon Mar 31 08:13:24 2008 Return-Path: X-Original-To: opsec-archive@optimus.ietf.org Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D1D293A6E5E; Mon, 31 Mar 2008 08:13:24 -0700 (PDT) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 162BD3A6E5E for ; Mon, 31 Mar 2008 08:13:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.059 X-Spam-Level: * X-Spam-Status: No, score=1.059 tagged_above=-999 required=5 tests=[AWL=1.207, BAYES_00=-2.599, RCVD_IN_NJABL_PROXY=1.643, SARE_RECV_SPEEDY_AR=0.808] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Fy28HDxI34Ha for ; Mon, 31 Mar 2008 08:13:22 -0700 (PDT) Received: from smtp1.xmundo.net (smtp1.xmundo.net [201.216.232.80]) by core3.amsl.com (Postfix) with ESMTP id 023D93A6D18 for ; Mon, 31 Mar 2008 08:13:21 -0700 (PDT) Received: from venus.xmundo.net (venus.xmundo.net [201.216.232.56]) by smtp1.xmundo.net (Postfix) with ESMTP id DDA025A8AC8; Mon, 31 Mar 2008 12:13:19 -0300 (ART) Received: from notebook.gont.com.ar (201-254-61-208.speedy.com.ar [201.254.61.208] (may be forged)) (authenticated bits=0) by venus.xmundo.net (8.13.8/8.13.8) with ESMTP id m2VFD6i4027619; Mon, 31 Mar 2008 12:13:08 -0300 Message-Id: <200803311513.m2VFD6i4027619@venus.xmundo.net> X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Mon, 31 Mar 2008 12:10:10 -0300 To: George M Jones , Fernando Gont From: Fernando Gont In-Reply-To: <47F0CB3B.5090506@mitre.org> References: <200803302248.m2UMmhSn014472@venus.xmundo.net> <47F0CB3B.5090506@mitre.org> Mime-Version: 1.0 X-Greylist: Sender succeeded SMTP AUTH authentication, not delayed by milter-greylist-3.0 (venus.xmundo.net [201.216.232.56]); Mon, 31 Mar 2008 12:13:18 -0300 (ART) Cc: opsec wg mailing list Subject: Re: [OPSEC] New I-D on ICMP filtering X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org At 08:30 a.m. 31/03/2008, George M Jones wrote: >state the existing specs in such detail ? >Would it be possible to have a summary table or something at the front ? Our take on providing "detailed pointers" to the specs is that you know where to look at if you want to make a more informed decision on whether to block the message or not, Additionally, you know where to look at if you want to understand the consequences of filtering the error messages better. I guess one could provide some sort of table.... but for many messages that would include "RFC1122" and "RFC792", which wouldn't shed much light? But that's just me thinking out loud. As mentioned in my post, this -00 version means to raise discussion among us on the best way to go. So we're open to any changes in the draft structure. Thanks! -- Fernando Gont e-mail: fernando@gont.com.ar || fgont@acm.org PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1 _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Tue Apr 1 08:01:22 2008 Return-Path: X-Original-To: opsec-archive@optimus.ietf.org Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9FA7B28C575; Tue, 1 Apr 2008 08:01:22 -0700 (PDT) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AD85628C566 for ; Tue, 1 Apr 2008 08:01:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CO-X2Q17ZsRG for ; Tue, 1 Apr 2008 08:01:15 -0700 (PDT) Received: from exprod7og101.obsmtp.com (exprod7og101.obsmtp.com [64.18.2.155]) by core3.amsl.com (Postfix) with ESMTP id 1971128C5A6 for ; Tue, 1 Apr 2008 07:59:23 -0700 (PDT) Received: from source ([66.129.224.36]) by exprod7ob101.postini.com ([64.18.6.12]) with SMTP; Tue, 01 Apr 2008 07:59:21 PDT Received: from proton.jnpr.net ([10.10.2.37]) by emailsmtp55.jnpr.net with Microsoft SMTPSVC(6.0.3790.1830); Tue, 1 Apr 2008 07:58:50 -0700 Received: from [172.23.1.71] ([172.23.1.71] RDNS failed) by proton.jnpr.net with Microsoft SMTPSVC(6.0.3790.1830); Tue, 1 Apr 2008 10:58:44 -0400 Message-ID: <47F24DA0.1090209@juniper.net> Date: Tue, 01 Apr 2008 10:58:40 -0400 From: Ron Bonica User-Agent: Mozilla Thunderbird 1.0.2 (Windows/20050317) X-Accept-Language: en-us, en MIME-Version: 1.0 To: Fernando Gont References: <200803302248.m2UMmhSn014472@venus.xmundo.net> In-Reply-To: <200803302248.m2UMmhSn014472@venus.xmundo.net> X-Enigmail-Version: 0.93.0.0 X-OriginalArrivalTime: 01 Apr 2008 14:58:44.0815 (UTC) FILETIME=[E1BFC5F0:01C89408] Cc: opsec wg mailing list Subject: Re: [OPSEC] New I-D on ICMP filtering X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org Fernando, This is an excellent document and I encourage you to post it. The following are a few comments: Section 1: Is your advice directed to ISPs? Enterprise Operators? SOHO users? Missing Section: You might want to add a Section up front that includes two tables. One table represents ICMPv4 and the other ICMPv6. Each table entry represents a type/code combination. Each table entry also includes a pointer to the section of the document that addresses the message type, and a recommendation to pass or filter the message. This section would also have to include a disclaimer stating the the recommendation is just that, a recommendation. Operators should look at the corresponding section and decide for them self whether the want to pass or filter the message. General: For many message types, the "Threats" and "Impact if blocked" are identical. So, it is tempting to merge these sections. However, this is not possible because the "Message Specification" and "Uses" are not identical. Maybe you can solve the problem by omitting the "Message Specification" and "Uses" sections and trusting the reader to read the reference documents. /individual contributor Ron P.S. I have not met Guillermo Gont. Are the authors brothers? Father and son? Fernando Gont wrote: > Folks, > > After quite some time of discussing this subject on the list, we have > finally published a (very drafty) internet draft on ICMP filtering. > Our draft borrows its structure from the wiki George Jones had > started on the subject. > > We have spent an extraordinary amount of time digging into the specs, > in the hope of being able to include pointers to the relevant RFCs > where each of the ICMP messages are defined (part of this work should > be credited to Carlos Pignataro). > > So far, we have included all this information in our draft, and have > already started populating the "uses", "security threats" and > "Operational implications if blocked" subsections corresponding to > each of the ICMP messages. > > We'd like to receive feedback on the structure of the draft. That is, > whether you are happy with the current structure of the draft (so > that we continue moving in this direction), or whether some changes > would be needed for you to feel happier about it. Among the possible > changes could be: > > * Discuss request/response messages in the same section, rather than > having subsections for each of them. I think the current structure > (having a subsection for each type/code) is good, but... > > * Changing the structure of the draft actually, the xml tag in the > xml source) so that "Uses", "Threats" and > "Operational/interoperability impact if blocked" are NOT "sections". > This would avoid section numbers having a fifth level of nesting > (e.g., 1.2.3.4.5)... but might be good for referencing a specific > part of this draft. > > Any other comments are welcome. > > The draft is available at the ID repository, but we have also put it > online (and in different fancy formats) at: > http://www.gont.com.ar/drafts/icmp-filtering/index.html > > Thanks! > > Kind regards, > > -- > Fernando Gont > e-mail: fernando@gont.com.ar || fgont@acm.org > PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1 > > > > > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec > _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Tue Apr 1 08:46:44 2008 Return-Path: X-Original-To: opsec-archive@optimus.ietf.org Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0FCE73A6D1E; Tue, 1 Apr 2008 08:46:44 -0700 (PDT) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A37583A6C46 for ; Tue, 1 Apr 2008 08:46:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.607 X-Spam-Level: X-Spam-Status: No, score=-1.607 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, DATE_IN_PAST_12_24=0.992] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IQW+tuRyThuv for ; Tue, 1 Apr 2008 08:46:41 -0700 (PDT) Received: from smtp1.xmundo.net (smtp1.xmundo.net [201.216.232.80]) by core3.amsl.com (Postfix) with ESMTP id 2832A3A6D1E for ; Tue, 1 Apr 2008 08:46:30 -0700 (PDT) Received: from venus.xmundo.net (venus.xmundo.net [201.216.232.56]) by smtp1.xmundo.net (Postfix) with ESMTP id B69885A8AFF; Tue, 1 Apr 2008 12:46:28 -0300 (ART) Received: from notebook.gont.com.ar (host253.190-139-181.telecom.net.ar [190.139.181.253]) (authenticated bits=0) by venus.xmundo.net (8.13.8/8.13.8) with ESMTP id m31FjsLI007988; Tue, 1 Apr 2008 12:46:14 -0300 Message-Id: <200804011546.m31FjsLI007988@venus.xmundo.net> X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Mon, 31 Mar 2008 13:39:55 -0300 To: Pekka Savola From: Fernando Gont In-Reply-To: References: <200803302248.m2UMmhSn014472@venus.xmundo.net> Mime-Version: 1.0 X-Greylist: Sender succeeded SMTP AUTH authentication, not delayed by milter-greylist-3.0 (venus.xmundo.net [201.216.232.56]); Tue, 01 Apr 2008 12:46:22 -0300 (ART) Cc: opsec wg mailing list Subject: Re: [OPSEC] New I-D on ICMP filtering X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org At 03:17 a.m. 31/03/2008, Pekka Savola wrote: >I was not involved in the discussions that led to this I-D, so I may >be missing something. > >This format would be great for reference documentation (e.g. as an >addon to RFC791/1122/1812 and various ICMP specs) as an int-area project. Yes, as a matter of fact, we had done much of the "digging" work in the hopes of publishing such a document. > From the OPsec perspective, I'd have thought that the most useful > output would be generated by starting by trying to develop > consensus on filtering practices, describe the tradeoffs when > consensus does not emerge and draw in support/analysis from > specifications only as necessary (rather than start from the specifications). I understand your point, and agree. mmm... are you suggesting to collapse each the "Message specification", "Uses", "Threats", and "Operational/interoperability implications if blocked" group of subsections into a single subsection? (and rather than having a verbose description of the relevant specs, simply state e.g., "specified by RFC792, RFC1122, and RFC1812"?) Or.... maybe for each message have a "Uses" subsection (that collapses a non-verbose version of the current "Message specification" and the current "uses" subsections), a "Threats" subsection (with a description on the security implications of the message) and a ""Operational/interoperability implications if blocked" section which discusses filtering of the corresponding messages? Any other suggestion will be more than welcome, as at this point we still have time to change the structure of the draft. What do other folks think about this? Thanks! -- Fernando Gont e-mail: fernando@gont.com.ar || fgont@acm.org PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1 _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Tue Apr 1 08:47:05 2008 Return-Path: X-Original-To: opsec-archive@optimus.ietf.org Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4505C28C2D7; Tue, 1 Apr 2008 08:47:05 -0700 (PDT) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 80F853A6DBA for ; Tue, 1 Apr 2008 08:47:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.607 X-Spam-Level: X-Spam-Status: No, score=-1.607 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, DATE_IN_PAST_12_24=0.992] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DV-t8lWZvF3m for ; Tue, 1 Apr 2008 08:47:03 -0700 (PDT) Received: from smtp1.xmundo.net (smtp1.xmundo.net [201.216.232.80]) by core3.amsl.com (Postfix) with ESMTP id 9FC5728C2D7 for ; Tue, 1 Apr 2008 08:46:41 -0700 (PDT) Received: from venus.xmundo.net (venus.xmundo.net [201.216.232.56]) by smtp1.xmundo.net (Postfix) with ESMTP id 8BD0F5A8AF6; Tue, 1 Apr 2008 12:46:41 -0300 (ART) Received: from notebook.gont.com.ar (host253.190-139-181.telecom.net.ar [190.139.181.253]) (authenticated bits=0) by venus.xmundo.net (8.13.8/8.13.8) with ESMTP id m31FkXsu008407; Tue, 1 Apr 2008 12:46:34 -0300 Message-Id: <200804011546.m31FkXsu008407@venus.xmundo.net> X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Mon, 31 Mar 2008 13:39:55 -0300 To: Pekka Savola From: Fernando Gont In-Reply-To: References: <200803302248.m2UMmhSn014472@venus.xmundo.net> Mime-Version: 1.0 X-Greylist: Sender succeeded SMTP AUTH authentication, not delayed by milter-greylist-3.0 (venus.xmundo.net [201.216.232.56]); Tue, 01 Apr 2008 12:46:40 -0300 (ART) Cc: opsec wg mailing list Subject: Re: [OPSEC] New I-D on ICMP filtering X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org At 03:17 a.m. 31/03/2008, Pekka Savola wrote: >I was not involved in the discussions that led to this I-D, so I may >be missing something. > >This format would be great for reference documentation (e.g. as an >addon to RFC791/1122/1812 and various ICMP specs) as an int-area project. Yes, as a matter of fact, we had done much of the "digging" work in the hopes of publishing such a document. > From the OPsec perspective, I'd have thought that the most useful > output would be generated by starting by trying to develop > consensus on filtering practices, describe the tradeoffs when > consensus does not emerge and draw in support/analysis from > specifications only as necessary (rather than start from the specifications). I understand your point, and agree. mmm... are you suggesting to collapse each the "Message specification", "Uses", "Threats", and "Operational/interoperability implications if blocked" group of subsections into a single subsection? (and rather than having a verbose description of the relevant specs, simply state e.g., "specified by RFC792, RFC1122, and RFC1812"?) Or.... maybe for each message have a "Uses" subsection (that collapses a non-verbose version of the current "Message specification" and the current "uses" subsections), a "Threats" subsection (with a description on the security implications of the message) and a ""Operational/interoperability implications if blocked" section which discusses filtering of the corresponding messages? Any other suggestion will be more than welcome, as at this point we still have time to change the structure of the draft. What do other folks think about this? Thanks! -- Fernando Gont e-mail: fernando@gont.com.ar || fgont@acm.org PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1 _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec