Subject: [secdir] Review of draft-ietf-ippm-duplicate-07.txt

From: "Hilarie Orman" <[email-masked]>
Date: Mon, 2 Feb 2009 13:29:28 -0700

draft-ietf-ippm-duplicate-07.txt describes metrics for reporting
results of packet duplication tests.  The tests use active packet
injection and monitoring to find duplicates.

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the
security area directors.  Document editors and WG chairs should treat
these comments just like any other last call comments.

I have only a minor comment to add to security considerations.  If an
attacker were to observe that these measurements were going on, he
might want to cause packet duplications.  This might lead network
operators to conclude that the "natural" duplication rate was high, in
turn causing them to set thresholds for "replay attacks" so high
that real attacks were overlooked.

For this reason, operators should consider the threat level to the
system under test, and if it is non-zero, and if the results might
be used by security administrators, the traffic used for testing
and for reporting results should be obscured as much as possible.

Hilarie Orman

_______________________________________________
secdir mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/secdir

---

From: Henk Uijterwaal <[email-masked]>
Date: Tue, 03 Feb 2009 12:36:29 +0100

Hilarie,

> that real attacks were overlooked.

Thresholds etc are beyond the scope of IPPM.  IPPM only specifies how
things should be measured.

That said, the optimal value for duplication is 0, that is, as an
operator I want every packet to arrive exactly once.  As soon as
there is duplication above the percent level, it is time to take
action.  A replay attack will typically involve every packet being sent
twice (once by the legitimate source and once by the attacker).
That translates into 100% duplication.  That is well above
the level any operator will ignore.

> be used by security administrators, the traffic used for testing

This is part of the IPPM framework.  Traffic used for testing should
be as similar to other traffic as possible, in order to avoid
preferential treatement by intermediate operators.

> and for reporting results should be obscured as much as possible.

Reporting results is outside the scope of the draft.

Henk

-- 
------------------------------------------------------------------------------
Henk Uijterwaal                           Email: henk.uijterwaal(at)ripe.net
RIPE Network Coordination Centre          http://www.amsterdamned.org/~henk
P.O.Box 10096          Singel 258         Phone: +31.20.5354414
1001 EB Amsterdam      1016 AB Amsterdam  Fax: +31.20.5354445
The Netherlands        The Netherlands    Mobile: +31.6.55861746
------------------------------------------------------------------------------

Belgium: an unsolvable problem, discussed in endless meetings, with no
          hope for a solution, where everybody still lives happily.
_______________________________________________
secdir mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/secdir

---

From: "Hilarie Orman" <[email-masked]>
Date: Tue, 3 Feb 2009 17:12:12 -0700

My comments do apply to how things should be measured.  Replay attacks
have no typical behavior wrt frequency, and malicious attempts to bias
duplication measurements would be surreptious.  I'm not sure that all
networks aim for zero duplications.  Surely some background level
exists.  It is all statistics.

There is a subtle difference between test traffic being "as similar as
possible" to other traffic "to avoid preferential treatment by
intermediate operators" and being undetectable to a malicious
adversary.

Hilarie

---

From: Henk Uijterwaal <[email-masked]>
Date: Wed, 04 Feb 2009 09:51:44 +0100

Hilarie Orman wrote:

 > I'm not sure that all

Duplication means that packets are sent twice.  That means that bandwidth
is wasted sending useless information and this is something operators do
not want.

> intermediate operators" and being undetectable to a malicious

You wrote "obscured" in your previous mail.  I think that is what one
does if one makes the measurement traffic as similar as possible to
other traffic.

Undetectable is impossible: take all packets between source and destination,
then plot the time between the packets.  If this distribution looks like
a poisson distribution over a long time, then there is high probability that
these are measurement systems.

Henk