Subject: [Sidrops] Statement of NCSC-NL on RPKI CVD process

From: "Jeroen van der Ham (NCSC-NL)" <[email-masked]>
Date: Fri, 29 Oct 2021 19:03:17 +0000

Hi,

I've joined this list to post the announcement of NCSC-NL regarding the concerns around the RPKI CVD process.

Please find our statement here:
https://english.ncsc.nl/latest/news/2021/october/29/upcoming-announcement-of-rpki-cvd-procedure

I will try as best as I can to answer any questions you may have.

Regards,
Jeroen.

---

From: Ben Maddison <[email-masked]>
Date: Sat, 30 Oct 2021 12:22:07 +0200

Hi Jeroen,

> I've joined this list to post the announcement of NCSC-NL regarding the concerns around the RPKI CVD process.
Welcome.

> I will try as best as I can to answer any questions you may have.
Excellent. I have several:

- My understanding of the openbsd disclosure policy referenced in the
  above link is that it relates to vulnerabilities specific to openbsd,
  and discovered by openbsd developers.
  I do not read it as saying: "if you attempt to inform us of something
  in good faith, and request that it be kept confidential in the
  legitimate interests of the Internet community, we will ignore you
  and post it on twitter".
  You appear to have arrived at the later interpretation.
  Did you or your colleagues have any actual conversations with anyone
  involved in rpki-client development that lead you to this conclusion?
  If so, on what dates did those conversations take place?

- When you did not hear back from Rob and Randy after your initial
  attempt to make contact, what further steps were taken to contact
  them, and on what dates?
  I occasionally find myself making email contact with Randy even when I
  do not intend to, so I have a hard time accepting that this posed such
  a difficulty.

- When you publish the details of the vulnerability, do you also plan to
  disclose the fact that you intentionally withheld details necessary to
  mitigate it from many of the very people that were in a position to do
  so?
  I hope that when operators find their infrastructure exposed on Monday
  afternoon, they will be able to make an informed decision about who to
  blame.

- The fact that you appear to have chosen only RP developers in your
  disclosure strategy suggests that you are of the opinion that the
  issue is not capable of mitigation without code changes.
  Presumably, you arrived at this conclusion through consultation with
  industry experts with meaningful experience operating RPKI
  infrastructure.
  Please confirm whether this was the case, and that you will be
  providing the details of those engagements along with your disclosure?

- Please would you elaborate on how you perceive the interests of the
  "cyber security of vital sectors" to be at odds with the developers of
  software designed to ensure said security?

- Please would you explain how your stated preference for "disclosure at
  a time when the solution is widely available" is consistent with your
  decision to selectively withhold information necessary to make such a
  solution widely available?

- Have you used ssh recently?

Regards,

Ben

---

From: Nick Hilliard <[email-masked]>
Date: Sat, 30 Oct 2021 15:37:45 +0100

Hi Jeroen,

thanks for dropping in.  Not sure that sidrops is the best forum for 
opsec discussion, but hopefully the chairs turn a blind eye.

The current situation seems to be that vulnerabilities will be announced 
on monday which allegedly affect both rcynic and rpki-client.

I don't have much visibility of where and how many sites rpki-client is 
used, but rcynic is used in production by both afrinic and jpnic.  If 
the set of vulnerabilities affects rpki integrity and the vulnerability 
details are released on monday without engagement with the authors of 
rcynic, then NCSC-NL is putting a very large amount of public 
infrastructure at risk.

It's a matter of public record that there was an attempt last wednesday 
to contact the rcynic authors.  Randy Bush's reply suggested that this 
was the first they had heard from you.

The terms that were dictated were unilateral and unacceptable from a 
vulnerability management point of view.  Specifically, they flouted 
well-established industry principles regarding vulnerability management, 
namely engagement and negotiation with stakeholders, and ensuring that 
software authors are happy that fixes can be done and tested well in 
advance of the planned disclosure date.

The best outcome here would be for all affected software to be patched 
and tested to the satisfaction of the authors well in advance of disclosure.

Can you describe how NCSC-NL will work to achieve this goal with the 
authors of rcynic and rpki-client?

thanks,

Nick

Jeroen van der Ham (NCSC-NL) wrote on 29/10/2021 20:03:
> _______________________________________________
> Sidrops mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sidrops
>

---

From: "Jeroen van der Ham (NCSC-NL)" <[email-masked]>
Date: Sun, 31 Oct 2021 14:31:53 +0000

Hi everyone,

We have updated our statement: https://english.ncsc.nl/latest/news/2021/october/29/upcoming-announcement-of-rpki-cvd-procedure

Most importantly: talks with OpenBSD have resumed, and we have postponed the disclosure.

Jeroen.

> -----Original Message-----
> From: Jeroen van der Ham (NCSC-NL)
> <Jeroen.vanderHam=[email-masked]>
> Sent: vrijdag 29 oktober 2021 21:03
> To: [email-masked]
> Subject: [Sidrops] Statement of NCSC-NL on RPKI CVD process
> 
> Hi,
>

---

From: Christopher Morrow <[email-masked]>
Date: Sun, 31 Oct 2021 20:22:51 -0400

Thank you for the update, and the delay in announcing. It would be great if
the fixed software were available with enough time to test and validate
prior to the announcement.

The global bgp infrastructure is operated by many entities, some of which
depend on working rpki validator software for safe operations of their (and
the wider) networks. Pushing everyone into an uncomfortable corner was
very... Unhelpful; (

Thanks!
-Chris

On Sun, Oct 31, 2021, 10:32 Jeroen van der Ham (NCSC-NL) <Jeroen.vanderHam=
[email-masked]> wrote:

> Hi everyone,
>
> We have updated our statement:

---

From: Randy Bush <[email-masked]>
Date: Sun, 31 Oct 2021 18:00:36 -0700

> prior to the announcement.

they did not even contact rtrlib folk; and rtrlib is incorporated into
vendor products.  this means a two stage fix and distribution.

here, for example, are grownups, with a three month disclosure window
https://www.lightbluetouchpaper.org/2021/11/01/trojan-source-invisible-vulnerabilities/

randy

---

From: Christopher Morrow <[email-masked]>
Date: Sun, 31 Oct 2021 23:29:23 -0400

> vendor products.  this means a two stage fix and distribution.

IDEALLY that also happens with this longer timeline.
IDEALLY that code is not vulnerable.. but .. who knows because no details?

As a network operator, for a reasonably sized network, I'm more than a tad
distressed about
how this process has been handled ;( I plan to see if there are folk in my
${CORPO} who interact
with the NCSC-NL and .. perhaps bend their ear about how this process went
down :(

I also plan to find utwente related folk at ${CORPO} and see if they can
bend ears in that forum.