Subject: RE: [Nea] Device compromise and NEA?

From: "Blumenthal, Uri" <[email-masked]>
Date: Thu, 18 May 2006 10:34:14 -0400

You don't remember that this fundamental question was already asked at
the last BOF by Bob Hinden in your presence? And that it was answered at
the mike right then and there? For the benefits of others who were not
present, I'm repeating that fundamental answer (as I happened to
contribute a part of it, as you might recall now).

First - there are hardware trust anchors that stand secure even when the
software gets compromised (for your education, look up TCG TPM
architecture, IBM Cell processor, AMD Presidio approach, and various
Intel technologies such as SIS/VISN). When those are employed, even a
"compromised" host may still be unable to falsify its posture. Posture
Collectors may well be protected by hardware. NEA doesn't protect a
system merely by itself. The greater its collaboration with other
security mechanisms - the greater its strength. 

Second - several people in the field, such as large enterprise customers
- expressed their need for a mechanism like NEA, EVEN if there is no
hardware-based security. Because in that case NEA acts for them as
"vaccination" rather than "cure". NEA can help IT to determine what
as-of-yet-healthy systems may need patches to their critical software,
etc - and put the unpatched ones to remediation network for scanning and
software  upgrade. So all the systems connected to the intranet stay at
the top of security level, currently available to IT department. Doesn't
guarantee health - but improves its likelihood considerably.

And to dispel illusions - no, NEA is not the answer to every problem on
the planet - and it is technically possible (though highly improbable)
that despite NEA and every other security technology utilized, a host is
compromised to such an extent that its posture CAN be falsified. So
what? We know that even bank vaults are occasionally burglarized -
because of that do we stop installing door locks (of normal size) and
security systems in our houses???

-----Original Message-----
From: Narayanan, Vidya [mailto:[email-masked]] 
Sent: Thursday, May 18, 2006 12:42 AM
To: [email-masked]
Subject: [Nea] Device compromise and NEA?

All,
I have a fundamental question regarding the NEA work. If a device is
compromised, how can there be any trust in the posture attributes that
it may be reporting? 

Vidya

_______________________________________________
Nea mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nea

_______________________________________________
Nea mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nea

---

From: "Michael Lindskov" <[email-masked]>
Date: Thu, 18 May 2006 12:39:25 -0400

I agree completely.  The main purpose of NEA needs to be keeping honest
systems honest.  Reality dictates that any host that is compromised could
potentially override just about any host based security system.  The point
is to prevent honest systems from getting infected by creating a necessity
for machines to stay up to date.  The idea behind NEA is that machines that
are kept up to date are harder to infect.  NEA works to motivate honest
users to keep things current. The motivation provided by NEA solutions
provides a lot of value. 

No single security layer can be considered sufficient and NEA should not be
expected to provide a perfect solution.  We should be more interested in
creating an architecture that is extensible and flexible.  That would allow
us to improve the technology in the future. (e.g. integration of hardware
based security features)  However, I don't think we can expect these
technologies to be integrated within the next year. 

NEA can provide value and should not be held up waiting for a better/perfect
solution.

Sincerely,
Michael Lindskov

-----Original Message-----
From: Narayanan, Vidya [mailto:[email-masked]] 
Sent: Thursday, May 18, 2006 12:42 AM
To: [email-masked]
Subject: [Nea] Device compromise and NEA?

All,

Vidya

---

From: "Marcus Leech" <[email-masked]>
Date: Thu, 18 May 2006 12:47:49 -0400

> security mechanisms - the greater its strength. 
The fact that there's a hardware device that signs data doesn't prevent 
that device from
  being lied to by the host computer that it's embedded in.   You know 
that, Uri.
  All that TPM gives you is "plausible-sounding lies".

But this work in NEA must proceed on the assumption that despite the 
fundamental
  "shaky science" aspects of all this, there's some value to it, and 
that to the extent
  that there's value in it, standardizing protocols and architectures is 
a good thing.

But we should never kid ourselves that "TPM fix everything".  It 
doesn't.  It's a cryptographic
  co-processor no different, from a high-level function perspective, 
than an ISO-7816 smartcard
  embedded in the machine.

You can't get around the Halting Problem, and you can't pretend that the 
host machines aren't
  Turing Complete.

---

From: "Stephen Hanna" <[email-masked]>
Date: Thu, 18 May 2006 13:00:24 -0400

Uri,

This was an excellent response. Thanks for sending it.

Take care,

Steve

---

From: "Stephen Hanna" <[email-masked]>
Date: Thu, 18 May 2006 13:04:34 -0400

Oops. Reply-All != Reply.

Thanks,

Steve

> From: Stephen Hanna 
> Sent: Thursday, May 18, 2006 1:00 PM
> To: Blumenthal, Uri; Narayanan, Vidya; [email-masked]