Re: [DNA] Issue 8: Modify Security Considerations

[Vijay Devarapalli <vijayd@iprg.nokia.com>]

JinHyeock Choi wrote:

> Vijay 
> 
> Thanks for your feedback. 
> 
> 
>>I am not sure I understood the issue. I agree that some secure
>>mechanism is need to detect crossing security boundaries before
>>a personal firewall is turned off. but why is this tied to SEND?
>>I dont see anything in SEND for detecting crossing security
>>boundaries.
>>
>>it might suffice to say, in the Security Considerations section,
>>that a secure mechanism is needed to detect crossing security
>>boundaries before taking actions like turning off personal
>>firewall and that DNA mechanisms might not be sufficient.
> 
> 
> Our line of thoughts are like below.
> 
> 1. With SEND, we can secure Router Discovery, such as Router 
>     Advertisement. 
> 2. With secured RA messages, we can secure DNA.  

this reasoning is flawed. who said all DNA mechanisms will be
based on RA messages?

> 3. With secured DNA mechanisms, a host can safely adjust its 
>     security based on which network link it believe it is attached to. 
> 4. Without secured DNA schemes, it's inadvisable to do so.  
> 
> We think that DNA schemes can be used to detect crossing security 
> boundaries indirectly and SEND can be used to secure DNA, so the 
> connection.  

that is your opinion. IMO, it doesnt belong in a Goals document.
what if I have never planned on using SEND. :)

>  
> It seems, however, that the phrases need clarification. How about this? 
> 
>    Because DNA schemes are based on Neighbor Discovery, its trust models
>    and threats are similar to the ones presented in [9].  Nodes
>    connected over wireless interfaces may be particularly susceptible to
>    jamming, monitoring and packet insertion attacks.
> 
>    Use of [7] to secure Neighbor Discovery is important in achieving
>    reliable detecting network attachment.  DNA schemes SHOULD
>    incorporate the solutions developed in IETF SEND WG if available,
>    where assessment indicates such procedures are required.
> 
>    With unsecured DNA schemes, it is inadvisable for a host to adjust
>    its security based on which network it believes it is attached to.
>    For example, it would be inappropriate for a host to disable its
>    personal firewall based on the belief that it had connected to a home
>    network.

just delete the second paragraph. you can still convey what you
want to in the Security Considerations section without that text.

   Because DNA schemes are based on Neighbor Discovery, its trust models
   and threats are similar to the ones presented in [9].  Nodes
   connected over wireless interfaces may be particularly susceptible to
   jamming, monitoring and packet insertion attacks.

   With unsecured DNA schemes, it is inadvisable for a host to adjust
   its security based on which network it believes it is attached to.
   For example, it would be inappropriate for a host to disable its
   personal firewall based on the belief that it had connected to a home
   network.

Vijay

ps: Reference [9] is RFC 3775. you probably wanted to say RFC 3756
which is reference [10]


> 
> I exchanged the second and the third part with slight modification to clarify 
> the paragraphs. Kindly comment on it. 
> 
> Thanks for your kind consideration. 
> 
> Best Regards
> 
> JinHyeock