Subject: [secdir] secdir review of draft-ietf-soc-overload-control-14

From: "Joseph Salowey (jsalowey)" <[email-masked]>
Date: Mon, 13 Jan 2014 04:44:58 +0000

I have reviewed this document as part of the security directorate's 
ongoing effort to review all IETF documents being processed by the 
IESG.  These comments were written primarily for the benefit of the 
security area directors.  Document editors and WG chairs should treat 
these comments just like any other last call comments.

I think this document is ready with some minor issues. 

First I like what you have done with the security considerations section.  It defines the attacks of concern in a clear way and describes some mitigations.  

1.   The security considerations section mentions several mitigations for false overload control messages including TCP, Websockets, BCP-38 and TLS.   While TCP and Websockets provide more protection than UDP its not clear to me that they are providing sufficient protection.   In addition, it seems that BCP-38 should be encouraged in all cases (not just the TLS case).   I'd feel better about the recommendation if it stated some thing like "TCP and Websockets in conjunction with BCP-38 make it more difficult for an attacker to insert or modify messages,  but it is still possible depending on where the attacker is positioned in the network.  TLS provides better protection from an attacker that has access to the network link."

2.  Some privacy considerations are mentioned in section 5.3.  Its not really clear to me what these considerations are so it would be good to expand upon them in the security considerations section.  

3.  Is it possible that some of the oc-agorithms might have their own security considerations.  If this is likely then it might be good to indicate the reader should check to see if the individual algorithm specifications security considerations. 

4.  Is there any mitigation for the attack involving a proxy that does not support mechanism from blindly forwarding an attacker's oc headers?

Cheers,

Joe

---

From: "Vijay K. Gurbani" <[email-masked]>
Date: Fri, 17 Jan 2014 15:41:15 -0600

On 01/12/2014 10:44 PM, Joseph Salowey (jsalowey) wrote:
> security area directors.  Document editors and WG chairs should
> treat these comments just like any other last call comments.
>

Joe: Thank you for your time and attention to the details of the
document in general, and the security considerations in particular.

Please see inline for possible resolutions and follow ups.

> First I like what you have done with the security considerations
> section.  It defines the attacks of concern in a clear way and
> describes some mitigations.

Excellent; thank you!

> 1.   The security considerations section mentions several mitigations
> for false overload control messages including TCP, Websockets, BCP-38
> and TLS.   While TCP and Websockets provide more protection than UDP
> its not clear to me that they are providing sufficient protection.
> In addition, it seems that BCP-38 should be encouraged in all cases
> (not just the TLS case).   I'd feel better about the recommendation
> if it stated some thing like "TCP and Websockets in conjunction with
> BCP-38 make it more difficult for an attacker to insert or modify
> messages,  but it is still possible depending on where the attacker
> is positioned in the network.  TLS provides better protection from an
> attacker that has access to the network link."

I think that is reasonable.  I can pretty much include the text you
provide above verbatim in Section 11 (Security Considerations) as
follows:

OLD:
    Attacks that indicate false overload control can be mitigated by
    using TCP or Websockets [RFC6455], or better yet, TLS in conjunction
    with applying BCP 38 [RFC2827].  Attacks that are mounted to suppress
    genuine overload conditions can be avoided by using TLS on the
    connection.

NEW:
    Attacks that indicate false overload control can be mitigated by
    using TCP or Websockets [RFC6455], or better yet, TLS in conjunction
    with applying BCP 38 [RFC2827].  Attacks that are mounted to suppress
    genuine overload conditions can be avoided by using TLS on the
    connection.  Generally, TCP and Websockets in conjunction with
    BCP-38 make it more difficult for an attacker to insert or modify
    messages,  but it is still possible depending on where the attacker
    is positioned in the network.  TLS provides better protection from
    an attacker that has access to the network link.

Let me know if that addresses your concern.

> 2.  Some privacy considerations are mentioned in section 5.3.  Its
> not really clear to me what these considerations are so it would be
> good to expand upon them in the security considerations section.

I think you meant Section 5.2, above (the word "privacy" appears in
Section 5.2).  Essentially, what is meant by the loss of privacy
here is the knowledge that a random upstream client gains --- without
much effort on its part ---  that the supports overload.  If, on the
other hand, the server had a policy of only indicating overload
support for those requests it received over a trusted channel where
the identity of the client could be asserted, then its may loosen
its inhibitions and indicate overload control.  It is the inadvertent
leakage of a capability (supports overload) to untrusted clients that
is of concern here.

I could insert a couple of sentences as the last paragraph of Section
11; candidate text below:

    Indicating support for overload control in a request received on
    an untrusted link can leak privacy in the form of capability support
    of the server.  To limit the knowledge that the server supports
    overload control, a server can adopt a policy of inserting overload
    control support in only those requests received over trusted links.

Reasonable?

> 3.  Is it possible that some of the oc-agorithms might have their own
> security considerations.  If this is likely then it might be good to
> indicate the reader should check to see if the individual algorithm
> specifications security considerations.

Do we need to add anything specific here?  If other overload control
algorithms beyond rate and loss are standardized, I suspect that they
will contain an appropriate Security Consideration section of their
own.  I am happy to add some text exhorting the implementor to
consult the specific overload control algorithm document if you feel
strongly about it.  Please let me know.

> 4.  Is there any mitigation for the attack involving a proxy that
> does not support mechanism from blindly forwarding an attacker's oc
> headers?

Alas, no.  As per the SIP processing rules, a proxy that does not
understand any Via header parameters is asked to simply tokenize
them on the way in and serialize them on the way out.  Thus, a
proxy that does not support this specification will simply forward
the overload control markings downstream.

Again, thanks for a close read.  Please let me know if the resolutions
specified in this email form a reasonable basis to move ahead.

Cheers,

- vijay
-- 
Vijay K. Gurbani, Bell Laboratories, Alcatel-Lucent
1960 Lucent Lane, Rm. 9C-533, Naperville, Illinois 60563 (USA)
Email: vkg@{bell-labs.com,acm.org} / [email-masked]
Web: http://ect.bell-labs.com/who/vkg/  | Calendar: http://goo.gl/x3Ogq