Subject: [Model-t] RFC 7624 threat model for Internet confidentiality in the phase of pervasive surveillance

From: John Mattsson <[email-masked]>
Date: Tue, 16 Nov 2021 07:37:53 +0000

Hi,

As far as I can see there has not been a single mail or document in Model-t mentioning RFC 7624, an IAB document which defines a threat model for Internet confidentiality in the phase of pervasive surveillance. RFC 7624 also has quite few references overall. This is a bit surprising.

I think RFC 7624 is an excellent and very useful document, especially the discussion and definition of various types of key exfiltration. I think most work in the IETF should consider if an attacker can get away with static key exfiltration and if it is possible to add mechanisms or guidance to force attackers to do dynamic key exfiltration. The output document(s) from Model-t should at a minimum reference RFC7624. If the output of Model-t results in IETF updating BCP 72, parts of RFC 7624 should likely be integrated in the updated document.

Also, how do we make sure that the output of Model-t is used more in the IETF work than RFC7624 has been so far?

Cheers,
John