Subject: [sacm] ECP question

From: Dan Ehrlich <[email-masked]>
Date: Fri, 12 Apr 2019 17:42:08 -0700

In the RFC for ECP, there is a section that mentions the potential use of
MAC addresses for identifying endpoints.

My understanding is that there are many things wrong with MAC addresses
today, such as that they can now be changed randomly by software, can't
really be verified, can be spoofed easily, etc.

I cannot find the link I was using from yesterday, but can the MAC address
mention be removed from ECP?

Apologies if I viewed an old draft or if this was previously discussed,

Dan Ehrlich
Austin, Texas
https://linkedin.com/in/danehrlich/
<https://www.linkedin.com/in/danehrlich/>

---

From: Dan Ehrlich <[email-masked]>
Date: Fri, 12 Apr 2019 17:45:24 -0700

Link I mentioned:
https://datatracker.ietf.org/doc/draft-ietf-sacm-ecp/?include_text=1

Section 3.2.1

---

From: "Banghart, Stephen A. (Fed)" <[email-masked]>
Date: Mon, 15 Apr 2019 19:45:32 +0000

Dan,

The link you posted had a small typo, here is a link to the datatracker page for the draft: https://datatracker.ietf.org/doc/draft-ietf-sacm-ecp/

Comments as a non-author:
The reference to MAC Addresses here is only really given as an example, it’s not a requirement or even much of a suggestion. While it’s true that MAC addresses are dubiously useful today, they are still valid to use as identifiers, and are still potentially useful as identifying information in the enterprise endpoint collection scenario (you mostly trust the endpoints in question).

Removing the reference entirely probably wouldn’t hurt anything, but the truth is that people use MAC addresses to track machines today, and pointing out that they can be used in this architecture as an ID is, IMO, worthwhile.

Perhaps a note on MAC addresses (And most hardware IDs) being flimsy could be present in the Security Considerations.

Cheers,
Stephen Banghart

From: sacm <[email-masked]> On Behalf Of Dan Ehrlich
Sent: Friday, April 12, 2019 8:45 PM
To: [email-masked]; [email-masked]
Subject: Re: [sacm] ECP question

Link I mentioned: https://datatracker.ietf.org/doc/draft-ietf-sacm-ecp/?include_text=1<https://datatracker.ietf..org/doc/draft-ietf-sacm-ecp/?include_text=1>

Section 3.2.1

On Fri, Apr 12, 2019 at 5:42 PM Dan Ehrlich <[email-masked]<mailto:[email-masked]>> wrote:
In the RFC for ECP, there is a section that mentions the potential use of MAC addresses for identifying endpoints.

My understanding is that there are many things wrong with MAC addresses today, such as that they can now be changed randomly by software, can't really be verified, can be spoofed easily, etc.

I cannot find the link I was using from yesterday, but can the MAC address mention be removed from ECP?

Dan Ehrlich
Austin, Texas
https://linkedin.com/in/danehrlich/<https://gcc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linkedin.com%2Fin%2Fdanehrlich%2F&data=02%7C01%7Cstephen.banghart%40nist.gov%7C66dbad907299401aacb808d6bfa969cd%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C0%7C636907131693188686&sdata=qn143EolA1Gh%2BU%2FMf6dwEhfP12%2BVXdI8TTn0kEX4zGo%3D&reserved=0>

---

From: Jessica Fitzgerald-McKay <[email-masked]>
Date: Fri, 26 Apr 2019 08:52:27 -0400

Dan,

Thank you for the review! Your understanding of MAC addresses mirrors mine:
they are not trustworthy as a sole device identifier. I think that, despite
that, they are still worth collection, for two reasons:

1) For device identity correlation-- For some network analytics, the MAC
address is what they can see. These analytics should have the capability to
correlate the behavior they see from an endpoint with a particular MAC
address to a better device identifier. One way to do that is to provide all
the identifiers an endpoint has (IP address, MAC address, device
certificate, etc.) to the CMDB. For traditional endpoints, the ECP requires
IF- IMC and (on the server side) IF-IMV. These interfaces allow endpoints
to share multiple forms of identity to the server, and then stored in the
CMDB for this sort of use case.

2) For attack identification-- ECP enables event-driven collection of
endpoint data. That is, if something changes on the endpoint, ECP enables
that change to be immediately (or, close to immediately) sent to the
server, and then to the CMDB. An endpoint could share any changes to its
MAC address as a part of that event-driven collection, which would help
network tools notice a malicious change in near-real-time.

Given these reasons, I would like to keep MAC addresses as a type of device
identity in the ECP.

I wonder if we could resolve your comments by including a note in the
security considerations about the trust limitations of MAC addresses. We
can say that they really should not be used as a sole device identifier,
and, if other identities can be reported, they really ought to be collected
at the same time as a MAC address. What do you think?

Thanks again for taking the time to share your thoughts!

Jess

On Fri, Apr 12, 2019 at 8:45 PM Dan Ehrlich <dan=
[email-masked]> wrote:

> <https://datatracker.ietf..org/doc/draft-ietf-sacm-ecp/?include_text=1>
>
> Section 3.2.1
>
> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm
>

---

From: Kathleen Moriarty <[email-masked]>
Date: Fri, 26 Apr 2019 10:06:06 -0400

Hi,

On Fri, Apr 26, 2019 at 8:52 AM Jessica Fitzgerald-McKay <[email-masked]>
wrote:

> Dan,
>
>
> Thank you for the review! Your understanding of MAC addresses mirrors
> mine: they are not trustworthy as a sole device identifier. I think that,
> despite that, they are still worth collection, for two reasons:
>
> Given these reasons, I would like to keep MAC addresses as a type of
> device identity in the ECP.
>

I think this is a good idea.  They may also be in a Privacy Considerations
section.  You may want to call out the scope of collection in this
description as well.  For instance, it may be recommended for use only
within a closed network (datacenter, managed network, enterprise, etc.).
For MAC addresses, randomization has been defined separately by multiple
vendors, but in ways that you can detect who the vendor is by their
randomization pattern.  Privacy work to mitigate that came out of IEEE to
standardize the randomization method across vendors.  I don't think that is
well deployed.

IMO, The section should touch on each of the identifier types and perhaps
limit the recommended scope of use as a precautionary measure to assist
with privacy. This will help address comments that could come in IETF last
call or from the IESG.

Thank you,
Kathleen

>>> In the RFC for ECP, there is a section that mentions the potential use
>>> of MAC addresses for identifying endpoints.
>>>

-- 

Best regards,
Kathleen