Subject: RE: [Nea] Device compromise and NEA?

From: "Blumenthal, Uri" <[email-masked]>
Date: Thu, 18 May 2006 13:16:11 -0400

Blumenthal, Uri wrote:
>> First - there are hardware trust anchors that stand secure even when
the
>> software gets compromised (for your education, look up TCG TPM
>> architecture, IBM Cell processor, AMD Presidio approach, and various
>> Intel technologies such as SIS/VISN). When those are employed, even a
>> "compromised" host may still be unable to falsify its posture.
Posture
>> Collectors may well be protected by hardware. NEA doesn't protect a
>> system merely by itself. The greater its collaboration with other
>> security mechanisms - the greater its strength. 
>   
> The fact that there's a hardware device that signs data doesn't
> prevent that device from being lied to by the host computer that
> it's embedded in.   You know that, Uri.

Yes I do - which is why I listed TPM as only ONE of several technologies
that can be used (together) to secure the host.

> But this work in NEA must proceed on the assumption that despite
> the fundamental "shaky science" aspects of all this, there's some
> value to it, and that to the extent that there's value in it,
> standardizing protocols and architectures is a good thing.

Certainly.

Paraphrasing - there are ways to steal a car, but their existence does
not invalidate the need for car locks.  :-)

> But we should never kid ourselves that "TPM fix everything". 
> It doesn't. 

No, of course not. And TPM will just as happily sign things for me as it
does for you (assuming I managed to steal the "access key"). 

But consider something like, say Embedded IT or Active Management
Technology (or similar initiatives by others) - it (together with TPM)
helps quite a bit.

> You can't get around the Halting Problem, and you can't pretend
> that the host machines aren't Turing Complete.

:-)  I'm not going to.  

_______________________________________________
Nea mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nea

---

From: "Narayanan, Vidya" <[email-masked]>
Date: Thu, 18 May 2006 11:49:58 -0700

Uri,

> 
> You don't remember that this fundamental question was already 
> asked at the last BOF by Bob Hinden in your presence? And 
> that it was answered at the mike right then and there? For 
> the benefits of others who were not present, I'm repeating 
> that fundamental answer (as I happened to contribute a part 
> of it, as you might recall now).
> 

I remember very well and in fact, went back to the minutes to re-read
the response before I sent this email :) I still lack clarity on this
point (maybe it is just my ignorance)! 

> First - there are hardware trust anchors that stand secure 
> even when the software gets compromised (for your education, 
> look up TCG TPM architecture, IBM Cell processor, AMD 
> Presidio approach, and various Intel technologies such as 
> SIS/VISN). When those are employed, even a "compromised" host 
> may still be unable to falsify its posture. Posture 
> Collectors may well be protected by hardware. NEA doesn't 
> protect a system merely by itself. The greater its 
> collaboration with other security mechanisms - the greater 
> its strength. 
> 

I admit that I'm not too familiar with the TCG TPM architecture -
however, I understand the basis you are talking about here. I saw that
Marcus made some excellent points here and don't feel the need to rehash
those. 

> Second - several people in the field, such as large 
> enterprise customers
> - expressed their need for a mechanism like NEA, EVEN if 
> there is no hardware-based security. Because in that case NEA 
> acts for them as "vaccination" rather than "cure". NEA can 
> help IT to determine what as-of-yet-healthy systems may need 
> patches to their critical software, etc - and put the 
> unpatched ones to remediation network for scanning and 
> software  upgrade. So all the systems connected to the 
> intranet stay at the top of security level, currently 
> available to IT department. Doesn't guarantee health - but 
> improves its likelihood considerably.
> 

While I can see some limited applicability here, I am very curious to
see the threat model for NEA. Perhaps I should wait for the security
analysis document. The plan is to have this prior to the next BoF,
right? 

> 
> And to dispel illusions - no, NEA is not the answer to every 
> problem on the planet - and it is technically possible 
> (though highly improbable) that despite NEA and every other 
> security technology utilized, a host is compromised to such 
> an extent that its posture CAN be falsified. So what? We know 
> that even bank vaults are occasionally burglarized - because 
> of that do we stop installing door locks (of normal size) and 
> security systems in our houses???
> 
> 

I don't see how it is highly improbable as you say above. If the point
of NEA is to ensure the health of well-behaved hosts, then, the scope
should explicitly say so. First of all, I see it as a huge deal of
complexity to even get to a point of posture attribute collection from
applications - on top of that, I see this solving a narrow use case. We
have to keep in mind that unless there is a big change in mindset, a
trusted kernel and trusted hardware needed to really make NEA useful
puts it out of the enterprise market. Even with that, this seems like a
perception of trust within a perimeter which does not necessarily
reflect reality! 

Regards,
Vidya

> 
> -----Original Message-----
> From: Narayanan, Vidya [mailto:[email-masked]]
> Sent: Thursday, May 18, 2006 12:42 AM
> To: [email-masked]
> Subject: [Nea] Device compromise and NEA?
> 
> 
> All,
> I have a fundamental question regarding the NEA work. If a device is
> compromised, how can there be any trust in the posture attributes that
> it may be reporting? 
> 
> Vidya
>