Subject: [P2PSIP] Initial slides for Wednesday

From: Eric Rescorla <[email-masked]>
Date: Sun, 02 Dec 2007 21:07:44 -0800

Here are my prototype slides for Tuesday's discussion.

-Ekr

_______________________________________________
P2PSIP mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/p2psip

---

From: "Henry Sinnreich" <[email-masked]>
Date: Mon, 3 Dec 2007 10:01:13 -0800

Certificates are a critical tool, but are they the only tool as implied
in slides? 

What a about other schemas that may be more effective as the case may
be:

At the p2p overlay, for routing, checking the consistency of the routing
table entries can tell us if there are misbehaving nodes:

http://www.cs.rice.edu/~dwallach/pub/osdi2002.pdf 

Between the app and p2p layers, secure interfaces are also defined in
the above.

At the application layer, I don't need certs for the entries in the
buddy list. Who is not my buddy (organizations) can be found and
contacted on the web.

I suggest adding some words to the effect when certificates are a good
option and what alternatives there are, for what scenarios.

Note: As H. Schulzrinne has mentioned, certifying a party that decides
to act with malice does not help with security. Observing malicious
behavior will do the trick far better.

Henry

-----Original Message-----
From: Eric Rescorla [mailto:[email-masked]] 
Sent: Sunday, December 02, 2007 11:08 PM
To: [email-masked]
Subject: [P2PSIP] Initial slides for Wednesday

-Ekr

---

From: "Bruce Lowekamp" <[email-masked]>
Date: Mon, 3 Dec 2007 10:10:43 -0800

Henry,

I think you're right that there are other aspects to the security
problem. Observing routing behavior is a very useful step since it
helps when an attacker gains control of a peerid.  Relying on
user-level authentication can also be useful in certain scenarios.

As that OSDI paper states, these techniques are complementary to, not
alternatives to, established techniques for authentication such as
certificates.  But we do need to discuss both.

Bruce

---

From: "Henry Sinnreich" <[email-masked]>
Date: Mon, 3 Dec 2007 10:24:20 -0800

Thanks Bruce for the agreement!

I should have added that a possible lightweight solution at the
application layer is to just store ZRTP "somethings" in my address book.
There would be no ZRTP entries for "uninteresting contacts" :-)

Reminder: What is the status of the ZRTP I-D? 
We may need it for P2PSIP sooner than later.

Henry

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Bruce
Lowekamp
Sent: Monday, December 03, 2007 12:11 PM
To: Henry Sinnreich
Cc: Eric Rescorla; [email-masked]
Subject: Re: [P2PSIP] Initial slides for Wednesday

Henry,

Bruce

---

From: Ali Fessi <[email-masked]>
Date: Mon, 03 Dec 2007 21:10:22 +0100

Dear Henry,

just few remarks:

actually the paper that u referenced (which is well known in the P2P
security community) confirms also that certified node-IDs are required:

Section 3 says: "The performance and security of structured p2p overlay
networks depend on the fundamental assumption that
there is a uniform random distribution of nodeIds that
cannot be controlled by an attacker."

It may be also worth it mentioning that *observing malicious behavior*
in a P2P network is not an obvious issue. and even if a malicious
behavior has been detected by a honest peer, the honest peer may not be
able to do anything against it.

If the honest peer is, for example, undergoing an eclipse attack, the UA
will not be able to receive phone calls, and the attack will not be
noticed, until the user tries to initiate a phone call.

But it all depends on the security requirements, and the deployment
scenarios. (e.g. the size of the P2PSIP network and the social environment).

If there is a requirement that "chosen location attacks" and "sybil
attacks" (which can together easily be used for an eclipse attack) need
to be avoided, then there is no way to overcome certified node-IDs.

By the way, ZRTP can solve the initial contact problem, but it can not 
make routing in the P2P network secure.

Hope this helps,

Cheers,
  Ali

-- 
Ali Fessi
Computer Networks and Internet
University of Tuebingen, Germany
Phone: +49 7071 29-70576 / Fax: +49 7071 29-5220
EMail: [email-masked]
Web: http://net.informatik.uni-tuebingen.de/~fessi/

---

From: Eric Rescorla <[email-masked]>
Date: Mon, 03 Dec 2007 13:02:29 -0800

At Mon, 3 Dec 2007 10:01:13 -0800,
> Certificates are a critical tool, but are they the only tool as implied

I don't think I said that they were. I've been asked to talk about
chosen location attacks so the slides are only about that.

> http://www.cs.rice.edu/~dwallach/pub/osdi2002.pdf 

This is only useful for detecting certain kinds of attacks.
And of course it only works well if you have secure node
assignment.

> buddy list. Who is not my buddy (organizations) can be found and

Well, I'm only talking about maintaining the consistency of the overlay,
and pretty much by definition, that means connections with people
you don't know well.

-Ekr

---

From: "Henry Sinnreich" <[email-masked]>
Date: Mon, 3 Dec 2007 14:02:23 -0800

Dear Ali,

I hope I was clear that certificates are critical, as you have mentioned
as well (for strong security supported by the enrolment server) but they
are not the only tool required, since there are also other options at
both the routing layer and the application layer.

> ZRTP can solve the initial contact problem, but it can not 
> make routing in the P2P network secure

ZRTP was suggested at the application layer.

"The best protocol design is when it is so simple that you cannot take
anything more away".

Henry

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Ali Fessi
Sent: Monday, December 03, 2007 12:10 PM
To: Henry Sinnreich
Cc: Eric Rescorla; [email-masked]
Subject: Re: [P2PSIP] Initial slides for Wednesday

Dear Henry,

just few remarks:

But it all depends on the security requirements, and the deployment
scenarios. (e.g. the size of the P2PSIP network and the social
environment).

Hope this helps,

Cheers,
  Ali

---

From: Alan Johnston <[email-masked]>
Date: Tue, 04 Dec 2007 12:09:59 -0600

Hi Henry,

In answer to your question about the status of ZRTP, it is working its 
way towards completion and publication as an informational RFC.

Thanks,
Alan.

Henry Sinnreich wrote:
>> Certificates are a critical tool, but are they the only tool as
>>     
> implied
>   
>> in slides?
>>
>> At the p2p overlay, for routing, checking the consistency of the
>>     
> routing
>