Subject: Re: [secdir] secdir review of draft-ietf-dime-priority-avps-04

From: Stephen Hanna <[email-masked]>
Date: Tue, 26 Jul 2011 06:52:45 -0400

Thanks for your response, Ken.

Removing the last sentence that you quoted would make things worse.
Readers of this draft should definitely familiarize themselves with
the security considerations related to priority. We should make that
easier, not harder. The fact that those considerations also apply to
other RFCs does not remove the fact that they apply to this one also.

You cannot publish a document whose security considerations section
says (as this one effectively does today), "There are lots of security
considerations related to this document. To understand them, please
dig through all the referenced documents and figure it out yourself."
Doing that digging and analysis is the job of the document editors.

In order to ease the burden on you, I think a reasonable compromise
would be for YOU to review the documents referenced and decide which
have the most relevant security considerations. Then you could list
those explicitly in the last paragraph of the Security Considerations.

Thanks,

steve

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> Sent: Tuesday, July 26, 2011 6:42 AM
> To: Stephen Hanna
> Cc: [email-masked]; [email-masked]; draft-ietf-dime-priority-
> [email-masked]; [email-masked]
> Subject: re: secdir review of draft-ietf-dime-priority-avps-04
> 
> Hi Steve,
> 
> Thanks for the review.
> 
> <snip>
> 
> > This standards track document defines Diameter AVPs that can be
> > used to convey a variety of priority parameters. While the Security
> > Considerations section of this document properly requires that
> > implementers review the Security Considerations section in the
> > Diameter protocol specification and consider the issues described
> > there, it does not include any analysis of the specific security
> > issues related to priority systems. The authors should review other
> > Security Considerations sections relating to priority systems
> > (e.g. the one in RFC 4412) and add text that describes the
> > special security issues that arise with priority systems and
> > the countermeasures that may be employed.
> 
> You raise an interesting issue and we actually had a discussion about
> this on the DIME list
> <http://www.ietf.org/mail-archive/web/dime/current/msg04773.html>
> 
> And just for the sake of completeness, here is the security
> considerations text of the dime-priority-avps draft in question:
> 
>     This document describes the extension of Diameter for conveying
> Quality
>     of Service information.  The security considerations of the
> Diameter
>     protocol itself have been discussed in [I-D.ietf-dime-rfc3588bis].
> Use
>     of the AVPs defined in this document MUST take into consideration
> the
>     security issues and requirements of the Diameter base protocol.
> 
>     The authors also recommend that readers should familiarize
> themselves
>     with the security considerations of the various protocols listed in
>     the Normative References listed below.
> 
> In a nutshell, the authors and the chair disagreed with the need for
> extending the security considerations to include an analysis with
> other protocols (eg, rfc-4412) because these protocols operate outside
> of the DIAMETER protocol.  The dime-priority-avps draft is an
> extension of I-D.ietf-dime-rfc3588bis, and thus is subject to the same
> security considerations to the bis draft.  And its also important to
> keep in mind that the dime-priority-avps draft does not inject
> prioritization into the exchange of DIAMETER messages.  It simply
> defines AVPs that correlate to some priority fields of other protocols.
> 
> If it was the last sentence (above) in the dime-priority-avps security
> considerations that has triggered your comment about further analysis,
> then I'd prefer just removing that text.
> 
> cheers,
> 
> -ken
>

---

From: [email-masked]
Date: Tue, 26 Jul 2011 10:41:35 +0000

Hi Steve,

Thanks for the review.

<snip>

    This document describes the extension of Diameter for conveying Quality
    of Service information.  The security considerations of the Diameter
    protocol itself have been discussed in [I-D.ietf-dime-rfc3588bis].  Use
    of the AVPs defined in this document MUST take into consideration the
    security issues and requirements of the Diameter base protocol.

    The authors also recommend that readers should familiarize themselves
    with the security considerations of the various protocols listed in
    the Normative References listed below.

cheers,

-ken

---

From: [email-masked]
Date: Tue, 26 Jul 2011 11:23:46 +0000

Steve,

> other RFCs does not remove the fact that they apply to this one also.

but those considerations do not directly apply to DIAMETER.

> Doing that digging and analysis is the job of the document editors.

agreed, speaking in the general sense.  But again, the security  
considerations of these other protocols do not apply to the operation  
of Diameter.

> those explicitly in the last paragraph of the Security Considerations.

I'm concerned about the implications of your recommendation.  If we  
extend this position to other work in the IETF, then efforts like  
defining MIBs would mean that each MIB draft would need to perform a  
security considerations analysis of each protocol that an objects  
refers to in the context of SNMP.  And one can extend the argument  
that each protocol operating on top of TCP (and/or UDP) and IP would  
need to perform an analysis on how TCP/UDP and IP may affect the upper  
layer protocol.  We don't do that today.

cheers,

-ken

---

From: Stephen Hanna <[email-masked]>
Date: Tue, 26 Jul 2011 11:34:27 -0400

Every RFC author has an obligation to explain in the Security Considerations
section what security issues are likely to arise when this specification is
used and how those issues may be addressed. You can refer to other RFCs if
you like but you cannot ignore the issues or just give a hand wave.

Let me give a specific example. If a user is able to ensure that their phone
calls always get the highest SIP-Resource-Priority, their calls will always
go through, even during a disaster. This will benefit the user so they have
an incentive to do it. However, it may damage the collective if calls from
emergency responders are overridden. For this reason, protection against
active MITM attacks SHOULD be employed when using Priority AVPs.

If you can find an extant RFC that covers the relevant Security Considerations
for your document, you can point to it and say that readers should review it
because the security considerations for this draft are contained there. But
you must perform a serious security analysis for your document if you want
it to be accepted as an RFC. If the answer is that there are no security
considerations, that's fine. You can say that. But in this case, that's
clearly not the case.

You raised the concern that documents may need to highlight security issues
with underlying protocols upon which they depend. That is true. If you're
depending on a protocol that has a serious security problem that's relevant
to your document, you should explain that problem or point to a document
that does so. If the problem is not relevant to your document, no problem.
One need not consider every possible security issue, just the ones that
are most relevant to your document. In your case, there are real security
issues particular to conveying priority AVPs over Diameter. You should
explain what those considerations are or point to documents that do so.
As for MIBs, take a look at some recent ones and you will see that they
do contain good Security Considerations sections. For example, see
RFC 5834 and RFC 6240.

If you'd like to learn more about how to write a good Security
Considerations section, read RFC 3552. Or ask a security expert
to help you. If you can't be bothered to think about security,
you might as well withdraw your draft from consideration.

Thanks,

Steve

> Sent: Tuesday, July 26, 2011 7:24 AM
> To: Stephen Hanna
> Subject: RE: secdir review of draft-ietf-dime-priority-avps-04
> 
> Steve,
> 
>

---

From: <[email-masked]>
Date: Tue, 26 Jul 2011 17:00:08 +0200

Hi Steve,

It should be maybe clarified (if required) that this document does not create a new protocol/solution. It only defines extensions to an existing protocol (Diameter QoS Application), completing a standard list of AVPs in order to support a set of parameters already defined in other specifications.

So, to be able to use this set of AVPs, you will have first to comply with the Diameter base protocol (RFC3588(bis)), the Diameter QoS application (RFC5866), the RFC 5624 defining the list of AVP, and all the different specifications defining these priority parameters. This document does not introduce new security issue. It just relies on existing solutions.

I understand therefore the concerns from Ken.

Regards,

Lionel

-----Message d'origine-----
De : [email-masked] [mailto:[email-masked]] 
Envoyé : mardi 26 juillet 2011 13:24
À : Stephen Hanna
Cc : [email-masked]; [email-masked]; [email-masked]; MORAND Lionel RD-CORE-ISS
Objet : RE: secdir review of draft-ietf-dime-priority-avps-04

Steve,

cheers,

-ken

---

From: <[email-masked]>
Date: Tue, 26 Jul 2011 20:26:08 +0200

Hi Stephen,

The example given below illustrates also what I'm thinking. And please forgive me if I miss something below.

IMHO, what you are saying about the SIP-Resource-Priority is true for any other QoS parameters carried over the Diameter QoS application. It is therefore why I'm assuming that the security considerations (http://tools.ietf.org/html/rfc5866#section-11) provided in the RFC 5866 is valid for any QoS related AVP, including the new set of AVPs defined in this document.

Would it make sense to refer to this section (instead of a copy/paste)? Would it solve the current issue?

Regards,

Lionel

-----Message d'origine-----
De : Stephen Hanna [mailto:[email-masked]] 
Envoyé : mardi 26 juillet 2011 17:34
À : [email-masked]
Cc : [email-masked]; [email-masked]; [email-masked]; MORAND Lionel RD-CORE-ISS
Objet : RE: secdir review of draft-ietf-dime-priority-avps-04

Thanks,

Steve