Subject: [perpass] "Its an attack" BCP draft

From: Stephen Farrell <[email-masked]>
Date: Wed, 20 Nov 2013 22:16:55 +0000

Hi all,

Following up on item 3a from the status/plan mail [1] I sent
last week, Hannes and myself have written up an I-D [2] that
tries to capture the consensus in the room from the Vancouver
tech plenary and we're proposing as a BCP.

We're deliberately trying to keep this short and sweet and to
not (yet) go beyond what was the gist of the hums - we think
progressing e.g. the threat model or the privacy BCP or other
bits of related work is liable to take longer and there's value
in documenting that the IETF as a whole has consensus on the
most significant bit first so those and other bits of work
don't all have to re-establish that as they are processed.
Hopefully we can all easily agree that that's a useful target
and focus comments on whether on not we've expressed that
consensus well or not.

<boring-bit>
We've been bouncing versions of this around amongst the IESG
and IAB for the last week, and process-wise, that has been
fun already. As you'll see from section 3 of the draft, we can
no longer just shoot out an RFC agreed by the IESG and IAB so
the plan for this is that when Hannes and I figure this looks
ready, based on your comments, then we'll ask Jari to start a
4-week IETF LC for it. When he thinks that's ok he'll start it
and then we'll see how that goes. Assuming that goes well, then
sometime during IESG evaluation the IAB will decide if they
like the final text (or not, which'd be "interesting") and if
they do then an IAB note saying "yep, we like it" will be added
sometime during/after IESG evaluation before this goes to the
RFC editor. In an ideal world, you'll all love the -00 already
and tell us that and we'll be done with all of the above super
duper process stuff by the end of the year. (Haven't we built
ourselves a lovely crazy process? ;-)

I really hope we don't end up with a process debate over this,
since the above, silly and all as it is, should achieve the
desirable outcome which is a simple BCP, approved by the IESG
after an IETF LC and also supported by the IAB. The value in
that is that it seems to be as close as we can get to the same
setup as RFCs 1984 and 2804 which is the right kind of heritage
for this one. So there is a reasonably good reason for the
process-crap.
</boring-bit>

Anyway, ignoring process, comments on this are welcome, so
please take a read of the two pages of content and let us know
what you think. If you do think its already good enough for
starting an IETF last call, then saying that is useful as well.

And since the IETF LC will happen on the [email-masked] list,
using this list for initial processing should be fine.

Cheers,
S.

[1] http://www.ietf.org/mail-archive/web/perpass/current/msg01016.html
[2] http://tools.ietf.org/html/draft-farrell-perpass-attack

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 21 Nov 2013 11:41:09 +1300

Just do it.

However, I am concerned by the 'bad actor' phrase. The problem is
that it's fine as explained in the draft, but it's highly likely to
be quoted out of context and thereby cause confusion. It would be
safer to use a neutral term ('observer'? 'surveyor'?).

Regards
   Brian

On 21/11/2013 11:16, Stephen Farrell wrote:
> _______________________________________________
> perpass mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/perpass
>

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 20 Nov 2013 22:43:52 +0000

> Just do it.

I wish:-)

> safer to use a neutral term ('observer'? 'surveyor'?).

Fair point, and "bad-actor" doesn't fit that well anyway. Will
find a better term or gladly take suggestions.

S.

---

From: joel jaeggli <[email-masked]>
Date: Wed, 20 Nov 2013 14:54:30 -0800

> find a better term or gladly take suggestions.

a surveillor and a surveyor are rather different things.

---

From: Rob Stradling <[email-masked]>
Date: Wed, 20 Nov 2013 23:05:19 +0000

> a surveillor and a surveyor are rather different things.

s/surveillor/surveillant/  ?

-- 
Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online
Office Tel: +44.(0)1274.730505
Office Fax: +44.(0)1274.730909
www.comodo.com

COMODO CA Limited, Registered in England No. 04058690
Registered Office:
   3rd Floor, 26 Office Village, Exchange Quay,
   Trafford Road, Salford, Manchester M5 3EQ

This e-mail and any files transmitted with it are confidential and 
intended solely for the use of the individual or entity to whom they are 
addressed.  If you have received this email in error please notify the 
sender by replying to the e-mail containing this attachment. Replies to 
this email may be monitored by COMODO for operational or business 
reasons. Whilst every endeavour is taken to ensure that e-mails are free 
from viruses, no liability can be accepted and the recipient is 
requested to use their own virus checking software.

---

From: Ted Lemon <[email-masked]>
Date: Wed, 20 Nov 2013 18:14:39 -0500

> s/surveillor/surveillant/  ?

Eavesdropper?   Has negative connotations, but only mildly so.

---

From: joel jaeggli <[email-masked]>
Date: Wed, 20 Nov 2013 15:19:44 -0800

> Eavesdropper?   Has negative connotations, but only mildly so.

bad actor is a value judgement. have no doubt that the intent of
surveillance is hostile with respect to the assumputions of the privacy
of one's communications.

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 20 Nov 2013 23:24:14 +0000

Its great how we can all focus in on one word:-) I infer
that means you're all ok with all the rest of 'em, but
even better if you said that.

Meanwhile I got an offlist suggestion:

OLD
   In particular, the
   term, when used technically, implies nothing about the motivation of
   the bad-actor mounting the attack, who is still called a bad-actor no
   matter what one really thinks about their motivation.

NEW
   In particular, the
   term, when used technically, implies nothing about the motivation of
   the actor mounting the attack.

Which I think is just fine so I've done that in the working version.

S.

On 11/20/2013 11:19 PM, joel jaeggli wrote:
> surveillance is hostile with respect to the assumputions of the
> privacy of one's communications.
> 
>> _______________________________________________ perpass mailing
>> list [email-masked] 
> _______________________________________________ perpass mailing
> list [email-masked]

---

From: Ted Lemon <[email-masked]>
Date: Wed, 20 Nov 2013 18:24:46 -0500

> surveillance is hostile with respect to the assumputions of the privacy

It's a lot softer to say "we have to treat passive surveillance as an attack because there is no way to distinguish between cases where it is and is not an attack" than it is to say "passive surveillance is an attack."

The document goes to some lengths not to examine the motivation of the eavesdropper, so finding a better term than "bad actor" makes sense to me.

---

From: Paul Ferguson <[email-masked]>
Date: Wed, 20 Nov 2013 15:26:29 -0800

> It's a lot softer to say "we have to treat passive surveillance as an attack because there is no way to distinguish between cases where it is and is not an attack" than it is to say "passive survei…

Strongly concur.

- ferg

-- 
Paul Ferguson
PGP Public Key ID: 0x63546533

---

From: "Fred Baker (fred)" <[email-masked]>
Date: Wed, 20 Nov 2013 23:31:21 +0000

I just read your ID.

I think the sense of the ID is pretty much correct. You half-define two words, "attack" and "mitigate", in saying something about what they are not (an attack, you say, has a "bad-actor", but implies nothing about the motivations of the attacker, and a "mitigation" doesn't make the attack go away, it merely makes it more expensive). I think you would do well to actually define the terms.

BTW, I think "bad actor" is a bad choice of words if you want to remove value judgements and motivations from the discussion. I'd suggest a more neutral term.

My definitions probably need work, but I think I'm looking for something like:

Glossary:

"Attack": In common English usage, an "attack" is an aggressive action perpetrated by an opponent, intended to enforce the opponent's will on the attacked party. In the Internet, the term is used to refer to a behavior that subverts the intent of a communicator without the knowledge of the parties to the communication. It may be active or passive. It may change the content of the communication, record the content of the communication, or through correlation with other communication events or attempts, reveal information the communicator did not intend to be revealed. It may also prevent communication or delay a time-sensitive communication more than its sensitivity permits. It may also have other effects that similarly subvert the intent of a communicator.

"Mitigation": As in common english usage, the term is used in the Internet in the sense of "make less severe, serious, or painful." (http://www.oxforddictionaries.com/us/definition/american_english/mitigate). Colloquially, the term is also used in the sense of making something of no effect, but this usage is not implied in the Internet context. If a person is cold, common english usage would consider the act of putting on a coat or the act of entering a warm building as mitigations. While the latter (making the matter of no effect) is desirable, for many purposes the former is cost-effective and sufficient for the purpose.

You might also walk through the document looking for run-on sentences and verbal lists. Search for the word "and", and ask yourself in each usage whether it could be usefully replaced with a period followed by the start of a new sentence. Search also for the word "or"; a list is "A, B, or C", not "A or B or C". In general, try to use simple sentences in active voice ("A does B to C"), as opposed to more complex sentences or passive voice ("B is done to C by A").

---

From: "Fred Baker (fred)" <[email-masked]>
Date: Wed, 20 Nov 2013 23:35:27 +0000

On Nov 20, 2013, at 3:31 PM, Fred Baker <[email-masked]> wrote:

> "Attack": In common English usage, an "attack" is an aggressive action perpetrated by an opponent, intended to enforce the opponent's will on the attacked party. In the Internet, the term is used to refer to a behavior that subverts the intent of a communicator without the knowledge of the parties to the communication. It may be active or passive. It may change the content of the communication, record the content of the communication, or through correlation with other communication events or attempts, reveal information the communicator did not intend to be revealed. It may also prevent communication or delay a time-sensitive communication more than its sensitivity permits.

It may force the communicator to spend money to mitigate attacks rather than pursue his personal or business interest.

> It may also have other effects that similarly subvert the intent of a communicator.
>

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 20 Nov 2013 23:42:20 +0000

Thanks Fred.

Interestingly RFC 4949 does define attack but not mitigation
(it does define countermeasure).

I think its a fair point that these need good definitions and
in this document. Pete Resnick btw, was the one who suggested
being specific about these terms. I had just assumed them as
obvious, but now see he (and you) are right about that.

I'll go over what 4949 says and your suggestions below and
come back with something tomorrow/Friday.

Cheers,
S.

On 11/20/2013 11:35 PM, Fred Baker (fred) wrote:
>> I think the sense of the ID is pretty much correct. You
>> half-define two words, "attack" and "mitigate", in saying
>> something about what they are not (an attack, you say, has a
>> "bad-actor", but implies nothing about the motivations of the
>> attacker, and a "mitigation" doesn't make the attack go away, it
>> merely makes it more expensive). I think you would do well to
>> actually define the terms.
>> 
>> BTW, I think "bad actor" is a bad choice of words if you want to
>> remove value judgements and motivations from the discussion. I'd
>> suggest a more neutral term.
>> 
>> "Attack": In common English usage, an "attack" is an aggressive
>> action perpetrated by an opponent, intended to enforce the
>> opponent's will on the attacked party. In the Internet, the term
>> is used to refer to a behavior that subverts the intent of a
>> communicator without the knowledge of the parties to the
>> communication. It may be active or passive. It may change the
>> content of the communication, record the content of the
>> communication, or through correlation with other communication
>> events or attempts, reveal information the communicator did not
>> intend to be revealed. It may also prevent communication or delay
>> a time-sensitive communication more than its sensitivity
>> permits.
> 
> It may force the communicator to spend money to mitigate attacks
> rather than pursue his personal or business interest.
> 
>> "Mitigation": As in common english usage, the term is used in the
>> Internet in the sense of "make less severe, serious, or painful."
>> (http://www.oxforddictionaries.com/us/definition/american_english/mitigate).
>> Colloquially, the term is also used in the sense of making
>> something of no effect, but this usage is not implied in the
>> Internet context. If a person is cold, common english usage would
>> consider the act of putting on a coat or the act of entering a
>> warm building as mitigations. While the latter (making the matter
>> of no effect) is desirable, for many purposes the former is
>> cost-effective and sufficient for the purpose.
>> 
>> 
>> 
>> You might also walk through the document looking for run-on
>> sentences and verbal lists. Search for the word "and", and ask
>> yourself in each usage whether it could be usefully replaced with
>> a period followed by the start of a new sentence. Search also for
>> the word "or"; a list is "A, B, or C", not "A or B or C". In
>> general, try to use simple sentences in active voice ("A does B
>> to C"), as opposed to more complex sentences or passive voice ("B
>> is done to C by A").
> 
> 
>

---

From: Ralf Skyper Kaiser <[email-masked]>
Date: Thu, 21 Nov 2013 11:47:32 +0000

Hi,

"...pervasive monitoring significantly more expensive or infeasible"

Recommend to remove 'significantly'. (otherwise there will be an argument
what 'significant' means. 1M USD? 10M USD? And how expensive is it anyway
to send a RST to 240M users? 1 cent? 1 Dollar?).

"...pervasive monitoring" means very widespread privacy-invasive gathering
of protocol"

Recommend to remove 'very' and 'privacy-invasive'. "Pervasive monitoring
means widespread gathering of protocol ...".

RFC1984 had more detail and these specifics in RFC1984 were helpful.  Some
specifics for this I-D:
ENCRYPT EVERYTHING
SECURITY BY DEFAULT
....please add?...

I-D does not touch regulatory changes (liability of service providers
towards its users and neglect when failing to support HTTPS for example).
Wish it did. (One reason why the internet is not secure is because the
manufactures get away shipping products that have all security features
disabled by default...or with default 0000 pins). (RFC1984 did mention
regulatory problems [export control] for example).

Rest is awesome!

regards,

Ralf

On Wed, Nov 20, 2013 at 10:16 PM, Stephen Farrell <[email-masked]
> wrote:

---

From: Yoav Nir <[email-masked]>
Date: Thu, 21 Nov 2013 13:58:24 +0000

On Nov 21, 2013, at 1:47 PM, Ralf Skyper Kaiser <[email-masked]> wrote:

> Recommend to remove 'significantly'. (otherwise there will be an argument what 'significant' means. 1M USD? 10M USD? And how expensive is it anyway to send a RST to 240M users? 1 cent? 1 Dollar?).

I agree there will be an argument. But don't you think we need some criterion for defining success?  If we increase the cost 1000x, they have to totally change their operating model. If we increase the cost 10x, they will have to scale back what they're doing. If we increase it 1.5x?  Probably just makes the American tax payer pay a little more.

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Thu, 21 Nov 2013 10:34:30 -0500

On Thu, Nov 21, 2013 at 8:58 AM, Yoav Nir <[email-masked]> wrote:

> > Recommend to remove 'significantly'. (otherwise there will be an
> argument what 'significant' means. 1M USD? 10M USD? And how expensive is it
> anyway to send a RST to 240M users? 1 cent? 1 Dollar?).
>
> I agree there will be an argument. But don't you think we need some
> criterion for defining success?  If we increase the cost 1000x, they have
> to totally change their operating model. If we increase the cost 10x, they
> will have to scale back what they're doing. If we increase it 1.5x?
>  Probably just makes the American tax payer pay a little more.
>
>
The criteria that is used inside the NSA is GDP of adversary * number of
years.

Which is about $10 Trillion * 10 = $100 Trillion

Which sounds a lot but we have billions of communications a day. So raising
the attack cost to $100K per communication is enough.

Website: http://hallambaker.com/

---

From: Jon Callas <[email-masked]>
Date: Thu, 21 Nov 2013 11:04:54 -0800

> find a better term or gladly take suggestions.

An appropriate term of art is "adversary."

	Jon

---

From: Robin Wilton <[email-masked]>
Date: Thu, 21 Nov 2013 23:27:31 +0000

I'm not sure I agree... in this context, "bad actors" are those who exploit their legitimate participation in a system to act in illegitimate ways, advancing their interests regardless of the disbenefit to others or to the system itself. 

That's not necessarily adversarial...

R

Robin Wilton
Technical Outreach Director - Identity and Privacy
Internet Society

email: [email-masked]
Phone: +44 705 005 2931
Twitter: @futureidentity

---

From: SM <[email-masked]>
Date: Thu, 21 Nov 2013 15:56:05 -0800

Hi Robin,
At 15:27 21-11-2013, Robin Wilton wrote:
>I'm not sure I agree... in this context, "bad actors" are those who 
>exploit their legitimate participation in a system to act in 
>illegitimate ways, advancing their interests regardless of the 
>disbenefit to others or to the system itself.
>

I am nitpicking instead of commenting about the draft. :-)

There is a SIDR draft written by Stephen Kent about threats.  It 
might be a useful read to figure out the right word(s).

Regards,
-sm

---

From: Stephen Kent <[email-masked]>
Date: Fri, 22 Nov 2013 09:56:44 -0500

Robin,

Jon is correct in term of the usual terminology employed in the security 
community.

Also, because we have said that we are trying to address passive wiretapping
effected by a wide range of adversaries, I don't think we're focusing 
exclusively
on entities who are "legitimate" participants.

Steve

---

From: Robin Wilton <[email-masked]>
Date: Fri, 22 Nov 2013 16:55:39 +0000

Fair points. 

There is something about the recent revelations that makes this idea seem important - of entities who have one nominal role in the 'ecosystem' but abuse that role to conceal harmful activity... but OK, we can reflect that in other ways than by the use of the term "bad actor".

Have a good weekend, everyone - 

Robin

Robin Wilton

email: [email-masked]
Phone: +44 705 005 2931
Twitter: @futureidentity

On 22 Nov 2013, at 14:56, Stephen Kent wrote:

> Robin,
> 
> Jon is correct in term of the usual terminology employed in the security community.
> 
> effected by a wide range of adversaries, I don't think we're focusing exclusively

---

From: Warren Kumari <[email-masked]>
Date: Fri, 22 Nov 2013 15:24:44 -0300

> It's a lot softer to say "we have to treat passive surveillance as an attack because there is no way to distinguish between cases where it is and is not an attack" than it is to say "passive survei…

Of course you can tell them apart -- simply require the passive surveillant to set the evil bit in all packets that they touch if it is an attack. If it is *not* an attack, they simply clear the evil bit. The originating party should randomly (with a good source of randomness (of course)) set the bit, and track which packets they did this on. The receiver should track which packets had it set. They then compare (out of band, and over a secure channel) which packets had the bit set, and can then determine, with some good probability of detection if someone was surveilling their traffic. 
I can extend this solution to other layers with an elegant solution involving checkboxes….

There,  I fixed it for you…

W

--
For every complex problem, there is a solution that is simple, neat, and wrong.
                -- H. L. Mencken

--
For every complex problem, there is a solution that is simple, neat, and wrong.
                -- H. L. Mencken

---

From: Dean Willis <[email-masked]>
Date: Sat, 23 Nov 2013 01:26:35 -0600

> safer to use a neutral term ('observer'? 'surveyor'?).

I like “perp”, which is cop-slang for “perpetrator”, which they now tend to say instead of “suspect”. But it fits nicely with “perpass”.

If the surveillors are the perp in perpass, what does that make the surveilled?  Donkeys?

—
Dean

---

From: Jari Arkko <[email-masked]>
Date: Wed, 27 Nov 2013 23:10:22 +0200

> then we'll ask Jari to start a
> and then we'll see how that goes.

I just wanted to send out a message saying that I'm watching this. 

Stephen's message had a lot of explanation of what the IAB and IESG think about it. I do think, however, the key is what the IETF thinks. Obviously. So lets keep those comments coming, so that Stephen/Hannes and I can do an initial assessment of what if anything needs to change in the -00 for me to start an IETF Last Call.

Jari