Subject: Re: [perpass] draft-farrell-perpass-attack architecture issue

From: "Fred Baker (fred)" <[email-masked]>
Date: Tue, 14 Jan 2014 21:45:31 +0000

On Jan 13, 2014, at 11:28 AM, Stephen Farrell <[email-masked]> wrote:

>  It means
>   that, if asked, there needs to be a good answer to the question "is
>   pervasive monitoring relevant to this work and if so how has it been
>   considered?"

Just a thought - that might be a good question to add to the shepherd's report.

In that case, I might suggest a minor change, however. We discuss "Pervasive monitoring" in a "big brother is watching" sense, and (at least in perpass) concern ourselves with data that could have been hidden had encryption or some other code used. I'll argue that, however dreadful Big Brother might be, location-based services can be a lot scarier.

http://online.wsj.com/news/articles/SB10001424052702303453004579290632128929194?mg=reno64-wsj&url=http%3A%2F%2Fonline.wsj.com%2Farticle%2FSB10001424052702303453004579290632128929194.html

Data point: a lot of these operate without specific knowledge of an individual, but can. For example, the article talks a lot about aggregating information and providing it without identifying information. However, it goes on to say that if someone logs into a service using, for example, a Facebook identifier, they can remain identified to the system as they wander around in it. The messages themselves contain no identifying information per se, but they contain information that can be correlated back to that login. And the login wasn't "data in flight", it was "creating state with a service at rest".

So the question in the shepherd's report should not be "tell me you thought about the EU Data Retention Initiative and whether your protocol's data identifies an individual". It should be "what personal, equipment, or session identifiers, encrypted or otherwise, are carried in your protocol? How might they be correlated with offline data or otherwise used to infer the identity or behavior of an individual?"

---

From: Melinda Shore <[email-masked]>
Date: Tue, 14 Jan 2014 13:00:13 -0900

On 1/14/14 12:45 PM, Fred Baker (fred) wrote:
> So the question in the shepherd's report should not be "tell me you
> thought about the EU Data Retention Initiative and whether your
> protocol's data identifies an individual". It should be "what
> personal, equipment, or session identifiers, encrypted or otherwise,
> are carried in your protocol? How might they be correlated with
> offline data or otherwise used to infer the identity or behavior of
> an individual?"

I agree - I think this is a useful framing, beyond the question
of actual traffic inspection.  It's pretty clear that there's
been a lot of data mining, as well, and we haven't thought very
carefully about what we may be leaking inadvertently.  This is
particularly a concern as efforts like geonet start to ramp
up.

Melinda

---

From: Scott Brim <[email-masked]>
Date: Tue, 14 Jan 2014 17:09:36 -0500

> So the question in the shepherd's report should not be "tell me you thought about the EU Data Retention Initiative and whether your protocol's data identifies an individual". It should be "what per…

The main problem is that: privacy issues are deeper than that, the
question could be misunderstood without a larger context, and there's
already a set of documents discussing most of that larger context (RFC
6973, the perpass problem statement draft, etc.).

The Document Shepherd Write-Up currently doesn't reference security
guidelines directly. Instead of asking a few specific questions in the
shepherd's writeup as you suggest, consider adding the privacy/perpass
docs to BCP 72 (which already includes RFC 3552) as they are approved,
and then optionally add a question to the shepherd's writeup that
refers to it, in order to emphasize the increased attention to the
issue.

Scott

---

From: "Fred Baker (fred)" <[email-masked]>
Date: Wed, 15 Jan 2014 08:00:55 +0000

On Jan 14, 2014, at 9:46 PM, Abdussalam Baryun <[email-masked]> wrote:
> The draft must include your questions, so that it can become a clear initial-BCP, or a clear plan draft. IMHO, the initial-BCP draft is not clear or not direct if it does not mention your questions,

I'm just one. But from my perspective, it must not only ask them, but answer them or outline how the answers might be arrived at.

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 15 Jan 2014 13:10:11 +0000

> particularly a concern as efforts like geonet start to ramp

I do like the idea that shepherds would report on this topic
(or more generally on security and privacy) in their write-ups,
but have a genetic dislike of the way we used to have a
1000-point questionnaire for shepherds to fill in. And a lot
of the current shepherd write-ups we get tend to be out of
date wrt e.g. IPR so I'm pretty convinced that we shouldn't
hardcode shepherd write-ups into RFCs on this topic, since
that level of process is liable to change relatively often.
OTOH, as a "new" thing for WGs to consider, it might be
quite useful if shepherds are prompted to not forget about
pervasive monitoring.

So I'm in two minds here really.

I figure that this is something where we'll have to learn as
we go. Maybe we should look at a tool that randomly (but
not uniformly randomly) picks a small number of hard questions
from a long list and asks the shepherd to answer those. Sort
of a write-up bingo;-)

I'd be interested if someone wanted to start work on some
WG-chair/shepherd guidance for how to consider pervasive
monitoring. That'd likely take a while to get baked, and
would maybe end up not (just) as an RFC, but as training
material and/or an IESG statement or something, but could
easily start as an I-D. Any takers?

S

---

From: Scott Brim <[email-masked]>
Date: Wed, 15 Jan 2014 09:27:42 -0500

> easily start as an I-D. Any takers?

I think we already have a lot of it. (1) Add RFC6973 to BCP72. (2)
Keep moving the perpass-related drafts forward, and add them as they
become mature. (3) In the shepherds writeup template, have a question
such as "(18) Describe the Document Shepherd's review of the security
considerations section (see BCP 72 for guidelines), especially with
regard to its consistency with the body of the document."

Scott

---

From: Eliot Lear <[email-masked]>
Date: Wed, 15 Jan 2014 15:33:06 +0100

Yeah, I think it's quite reasonable for a shepherd to ask the developers
of a spec how they have considered PM, and see if it at least passes a
sniff test.

Eliot

On 1/15/14 2:10 PM, Stephen Farrell wrote:
> _______________________________________________
> perpass mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/perpass
>
>

---

From: Jari Arkko <[email-masked]>
Date: Sun, 19 Jan 2014 15:03:43 +0200

> refers to it, in order to emphasize the increased attention to the

FWIW, I do not feel strongly about this topic but my personal opinion is that if we do something with the shepherd write-up, it should be on the general level outlined by Scott above. (But I think the documents themselves are more important than the write-ups. A few years down the road, I'm sure the reader like to know what the thinking on security was on such and such RFC. On any aspect of security, PM or otherwise. When there's something to say, of course, which isn't always.)

Jari