idnits 2.17.1 draft-arkko-farrell-arch-model-t-7258-additions-00.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- No issues found here. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (July 14, 2020) is 1381 days in the past. Is this intentional? Checking references for intended status: Informational ---------------------------------------------------------------------------- == Outdated reference: A later version (-04) exists of draft-arkko-farrell-arch-model-t-03 Summary: 0 errors (**), 0 flaws (~~), 2 warnings (==), 1 comment (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 Network Working Group J. Arkko 3 Internet-Draft Ericsson 4 Intended status: Informational S. Farrell 5 Expires: January 15, 2021 Trinity College Dublin 6 July 14, 2020 8 RFC 7258 additions due to evolving Internet thread model 9 draft-arkko-farrell-arch-model-t-7258-additions-00 11 Abstract 13 Communications security has been at the center of many security 14 improvements in the Internet. The goal has been to ensure that 15 communications are protected against outside observers and attackers. 17 RFC 7258 is the IETF guidance on taking into account pervasive 18 monitoring threats in Internet technology development work. This 19 memo suggests additions to RFC 7258 to cater for the evolving 20 threats. For instance, it may be necessary to also worry about 21 information collected by a legitimate protocol participant being 22 misused for pervasive monitoring purposes. 24 Status of This Memo 26 This Internet-Draft is submitted in full conformance with the 27 provisions of BCP 78 and BCP 79. 29 Internet-Drafts are working documents of the Internet Engineering 30 Task Force (IETF). Note that other groups may also distribute 31 working documents as Internet-Drafts. The list of current Internet- 32 Drafts is at https://datatracker.ietf.org/drafts/current/. 34 Internet-Drafts are draft documents valid for a maximum of six months 35 and may be updated, replaced, or obsoleted by other documents at any 36 time. It is inappropriate to use Internet-Drafts as reference 37 material or to cite them other than as "work in progress." 39 This Internet-Draft will expire on January 15, 2021. 41 Copyright Notice 43 Copyright (c) 2020 IETF Trust and the persons identified as the 44 document authors. All rights reserved. 46 This document is subject to BCP 78 and the IETF Trust's Legal 47 Provisions Relating to IETF Documents 48 (https://trustee.ietf.org/license-info) in effect on the date of 49 publication of this document. Please review these documents 50 carefully, as they describe your rights and restrictions with respect 51 to this document. Code Components extracted from this document must 52 include Simplified BSD License text as described in Section 4.e of 53 the Trust Legal Provisions and are provided without warranty as 54 described in the Simplified BSD License. 56 Table of Contents 58 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 59 2. Security Considerations . . . . . . . . . . . . . . . . . . . 3 60 3. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 3 61 4. References . . . . . . . . . . . . . . . . . . . . . . . . . 3 62 4.1. Normative References . . . . . . . . . . . . . . . . . . 3 63 4.2. Informative References . . . . . . . . . . . . . . . . . 3 64 Appendix A. Acknowledgements . . . . . . . . . . . . . . . . . . 3 65 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 4 67 1. Introduction 69 Communications security has been at the center of many security 70 improvements in the Internet. The goal has been to ensure that 71 communications are protected against outside observers and attackers. 72 At the IETF, this approach has been formalized in BCP 72 [RFC3552], 73 which defined the Internet threat model in 2003. Additional guidance 74 to take into account dangers posed by pervasive monitoring were 75 covered in BCP 188 [RFC7258]. 77 However, threats in the Internet continue to evolve, as discussed in 78 [I-D.arkko-farrell-arch-model-t]. 80 The rest of this document tentatively suggests a small (but our view, 81 important) change to the BCP. 83 Comments are solicited on this document. The best place for 84 discussion is on the model-t list. 85 (https://www.ietf.org/mailman/listinfo/model-t) # Potential Changes 86 in BCP 188/RFC 7258 {#changes7258} 88 Additional guidelines may be necessary also in BCP 188/RFC 89 7258[RFC7258], which specifies how IETF work should take into account 90 pervasive monitoring. 92 An initial, draft suggestion for starting point of those changes 93 could be adding the following paragraph after the 2nd paragraph in 94 Section 2: 96 NEW: 98 PM attacks include those cases where information collected by a 99 legitimate protocol participant is misused for PM purposes. The 100 attacks also include those cases where a protocol or network 101 architecture results in centralized data storage or control 102 functions relating to many users, raising the risk of said misuse. 104 2. Security Considerations 106 The entire memo covers the security considerations. 108 3. IANA Considerations 110 There are no IANA considerations in this work. 112 4. References 114 4.1. Normative References 116 [RFC3552] Rescorla, E. and B. Korver, "Guidelines for Writing RFC 117 Text on Security Considerations", BCP 72, RFC 3552, 118 DOI 10.17487/RFC3552, July 2003, 119 . 121 [RFC7258] Farrell, S. and H. Tschofenig, "Pervasive Monitoring Is an 122 Attack", BCP 188, RFC 7258, DOI 10.17487/RFC7258, May 123 2014, . 125 4.2. Informative References 127 [I-D.arkko-farrell-arch-model-t] 128 Arkko, J. and S. Farrell, "Challenges and Changes in the 129 Internet Threat Model", draft-arkko-farrell-arch-model- 130 t-03 (work in progress), March 2020. 132 Appendix A. Acknowledgements 134 The authors would like to thank the IAB: 136 Alissa Cooper, Wes Hardaker, Ted Hardie, Christian Huitema, Zhenbin 137 Li, Erik Nordmark, Mark Nottingham, Melinda Shore, Jeff Tantsura, 138 Martin Thomson, Brian Trammel, Mirja Kuhlewind, and Colin Perkins. 140 The authors would also like to thank the participants of the IETF 141 SAAG meeting where this topic was discussed: 143 Harald Alvestrand, Roman Danyliw, Daniel Kahn Gilmore, Wes Hardaker, 144 Bret Jordan, Ben Kaduk, Dominique Lazanski, Eliot Lear, Lawrence 145 Lundblade, Kathleen Moriarty, Kirsty Paine, Eric Rescorla, Ali 146 Rezaki, Mohit Sethi, Ben Schwartz, Dave Thaler, Paul Turner, David 147 Waltemire, and Jeffrey Yaskin. 149 The authors would also like to thank the participants of the IAB 2019 150 DEDR workshop: 152 Tuomas Aura, Vittorio Bertola, Carsten Bormann, Stephane Bortzmeyer, 153 Alissa Cooper, Hannu Flinck, Carl Gahnberg, Phillip Hallam-Baker, Ted 154 Hardie, Paul Hoffman, Christian Huitema, Geoff Huston, Konstantinos 155 Komaitis, Mirja Kuhlewind, Dirk Kutscher, Zhenbin Li, Julien 156 Maisonneuve, John Mattson, Moritz Muller, Joerg Ott, Lucas Pardue, 157 Jim Reid, Jan-Frederik Rieckers, Mohit Sethi, Melinda Shore, Jonne 158 Soininen, Andrew Sullivan, and Brian Trammell. 160 The authors would also like to thank the participants of the November 161 2016 meeting at the IETF: 163 Carsten Bormann, Randy Bush, Tommy C, Roman Danyliw, Ted Hardie, 164 Christian Huitema, Ben Kaduk, Dirk Kutscher, Dominique Lazanski, Eric 165 Rescorla, Ali Rezaki, Mohit Sethi, Melinda Shore, Martin Thomson, and 166 Robin Wilton 168 Finally, the authors would like to thank numerous other people for 169 insightful comments and discussions in this space. 171 Authors' Addresses 173 Jari Arkko 174 Ericsson 175 Valitie 1B 176 Kauniainen 177 Finland 179 Email: jari.arkko@piuha.net 181 Stephen Farrell 182 Trinity College Dublin 183 College Green 184 Dublin 185 Ireland 187 Email: stephen.farrell@cs.tcd.ie