Subject: [tsvwg] Circuit Breakers: Proposed new security text.

From: [email-masked]
Date: Tue, 3 Nov 2015 10:45:15 -0000

This email is an attempt to address just the security comment raised by
Bob Briscoe:

> I think the draft should recommend that for most scenarios, randomized
> ports will be insufficient protection for CB control messages, which
> should be properly crytographically authenticated. Otherwise, a
> CB-controlled aggregate is too vulnerable to these off-path attacks.

At the moment I do not know why off-path protection is not enough for some
use cases, but see the need for more text concerning on-path attacks. I
wonder if the text below could be acceptable:

"A Circuit Breaker could potentially be exploited by an attacker to mount
a Denial of Service (DoS) attack against the traffic being measured.
Mechanisms therefore need to be implemented to prevent attacks on the
network control information that would result in DoS. The source and
integrity of control information (measurements and triggers) MUST be
protected from off-path attacks. Without protection, it could be trivial
for an attacker to inject fake or modified control/measurement messages
(e.g., indicating high packet loss rates) causing a Circuit Breaker to
trigger and to therefore mount a DoS attack that disrupts a flow.

Simple protection can be provided by using a randomized source port, or
equivalent field in the packet header (such as the RTP SSRC value and the
RTP sequence number) expected not to be known to an off-path attacker.
Stronger protection can be achieved using a secure authentication
protocol. This attack is relatively easy for an on-path attacker when the
messages are neither encrypted nor authenticated. When there is a risk of
on-path attack, a cryptographic authentication mechanism for all
control/measurement messages is RECOMMENDED to mitigate this concern."

Bob, Colin, others? - Would this text seem a reasonable position to take
in the security considerations?

If so I will also make a corresponding one-line update to section 4
pointing to this recommendation.

Best wishes,

Gorry

---

From: Bob Briscoe <[email-masked]>
Date: Thu, 5 Nov 2015 01:24:34 +0000

Gorry,

> control/measurement messages is RECOMMENDED to mitigate this concern."
I think the deciding factor is more to do with the potential impact of 
an attack, than the risk of the mere existence of an on-path attack.

For instance, if the circuit breaker is controlling a tunnel that 
contains live paid-for telephony traffic, the operator would be more 
concerned about proper crypto protection.

Nonetheless, you're right that this can only point out the issues and 
recommend. It will not be IETF policy that decides this issue. It will 
be (and should be) operator policy.

Bob

-- 
________________________________________________________________
Bob Briscoe                               http://bobbriscoe.net/

---

From: [email-masked]
Date: Thu, 5 Nov 2015 02:02:47 -0000

>> pointing to this recommendation.
I now understand what you say. I think some text could be added to the
security considerations to say something like:

OLD:
When there is a risk of on-path attack, a cryptographic authentication
mechanism for all control/measurement messages is RECOMMENDED to mitigate
this concern.

NEW:
When there is a risk of on-path attack, a cryptographic authentication
mechanism for all control/measurement messages is RECOMMENDED to mitigate
this concern.
There is a design trade-off between the cost of introducing cryptographic
security for control messages and the desire to protect from an attack on
the control communication. For some deployment scenarios the value of
additional protection from DoS attack will therefore lead to a requirement
that authentication is used for all control messages.

Would you like to see more?

Gorry

---

From: Bob Briscoe <[email-masked]>
Date: Thu, 5 Nov 2015 02:14:44 +0000

Gorry,

That text is correct. Thx
Would I like to see more? Well, less would be preferred - it could be 
clearer if shorter, rather than just adding more. But I'm happy if you 
don't have the time to be briefer.

Bob

---

From: [email-masked]
Date: Thu, 5 Nov 2015 02:21:55 -0000

OK, I'll add something on this. I'll also see if I can get it shorter.

Gorry

---

From: Colin Perkins <[email-masked]>
Date: Fri, 6 Nov 2015 22:31:40 +0900

Gorry,

> On 3 Nov 2015, at 19:45, [email-masked] wrote:
> 

This is fine with me.

Colin

-- 
Colin Perkins
https://csperkins.org/