idnits 2.17.1 draft-arkko-farrell-arch-model-t-7258-additions-02.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- No issues found here. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (February 22, 2021) is 1149 days in the past. Is this intentional? Checking references for intended status: Informational ---------------------------------------------------------------------------- == Outdated reference: A later version (-01) exists of draft-arkko-farrell-arch-model-t-redux-00 Summary: 0 errors (**), 0 flaws (~~), 2 warnings (==), 1 comment (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 Network Working Group J. Arkko 3 Internet-Draft Ericsson 4 Intended status: Informational S. Farrell 5 Expires: August 26, 2021 Trinity College Dublin 6 February 22, 2021 8 RFC 7258 additions due to evolving Internet thread model 9 draft-arkko-farrell-arch-model-t-7258-additions-02 11 Abstract 13 Communications security has been at the center of many security 14 improvements in the Internet. The goal has been to ensure that 15 communications are protected against outside observers and attackers. 17 RFC 7258 is the IETF guidance on taking into account pervasive 18 monitoring threats in Internet technology development work. This 19 memo suggests additions to RFC 7258 to cater for the evolving 20 threats. For instance, it may be necessary to also worry about 21 information collected by a legitimate protocol participant being 22 misused for pervasive monitoring purposes. 24 Status of This Memo 26 This Internet-Draft is submitted in full conformance with the 27 provisions of BCP 78 and BCP 79. 29 Internet-Drafts are working documents of the Internet Engineering 30 Task Force (IETF). Note that other groups may also distribute 31 working documents as Internet-Drafts. The list of current Internet- 32 Drafts is at https://datatracker.ietf.org/drafts/current/. 34 Internet-Drafts are draft documents valid for a maximum of six months 35 and may be updated, replaced, or obsoleted by other documents at any 36 time. It is inappropriate to use Internet-Drafts as reference 37 material or to cite them other than as "work in progress." 39 This Internet-Draft will expire on August 26, 2021. 41 Copyright Notice 43 Copyright (c) 2021 IETF Trust and the persons identified as the 44 document authors. All rights reserved. 46 This document is subject to BCP 78 and the IETF Trust's Legal 47 Provisions Relating to IETF Documents 48 (https://trustee.ietf.org/license-info) in effect on the date of 49 publication of this document. Please review these documents 50 carefully, as they describe your rights and restrictions with respect 51 to this document. Code Components extracted from this document must 52 include Simplified BSD License text as described in Section 4.e of 53 the Trust Legal Provisions and are provided without warranty as 54 described in the Simplified BSD License. 56 Table of Contents 58 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 59 2. Potential Changes in BCP 188/RFC 7258 . . . . . . . . . . . . 2 60 3. Security Considerations . . . . . . . . . . . . . . . . . . . 3 61 4. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 3 62 5. References . . . . . . . . . . . . . . . . . . . . . . . . . 3 63 5.1. Normative References . . . . . . . . . . . . . . . . . . 3 64 5.2. Informative References . . . . . . . . . . . . . . . . . 3 65 Appendix A. Acknowledgements . . . . . . . . . . . . . . . . . . 3 66 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 4 68 1. Introduction 70 Communications security has been at the center of many security 71 improvements in the Internet. The goal has been to ensure that 72 communications are protected against outside observers and attackers. 73 At the IETF, this approach has been formalized in BCP 72 [RFC3552], 74 which defined the Internet threat model in 2003. Additional guidance 75 to take into account dangers posed by pervasive monitoring were 76 covered in BCP 188 [RFC7258]. 78 However, threats in the Internet continue to evolve, as discussed in 79 [I-D.arkko-farrell-arch-model-t-redux]. 81 The rest of this document tentatively suggests a small (but our view, 82 important) change to the BCP. 84 Comments are solicited on this document. The best place for 85 discussion is on the model-t list. 86 (https://www.ietf.org/mailman/listinfo/model-t) 88 2. Potential Changes in BCP 188/RFC 7258 90 Additional guidelines may be necessary also in BCP 188/RFC 91 7258[RFC7258], which specifies how IETF work should take into account 92 pervasive monitoring. 94 An initial, draft suggestion for starting point of those changes 95 could be adding the following paragraph after the 2nd paragraph in 96 Section 2: 98 NEW: 100 PM attacks include those cases where information collected by a 101 legitimate protocol participant is misused for PM purposes. The 102 attacks also include those cases where a protocol or network 103 architecture results in centralized data storage or control 104 functions relating to many users, raising the risk of said misuse. 106 3. Security Considerations 108 The entire memo covers the security considerations. 110 4. IANA Considerations 112 There are no IANA considerations in this work. 114 5. References 116 5.1. Normative References 118 [RFC3552] Rescorla, E. and B. Korver, "Guidelines for Writing RFC 119 Text on Security Considerations", BCP 72, RFC 3552, 120 DOI 10.17487/RFC3552, July 2003, 121 . 123 [RFC7258] Farrell, S. and H. Tschofenig, "Pervasive Monitoring Is an 124 Attack", BCP 188, RFC 7258, DOI 10.17487/RFC7258, May 125 2014, . 127 5.2. Informative References 129 [I-D.arkko-farrell-arch-model-t-redux] 130 Arkko, J. and S. Farrell, "Internet Threat Model 131 Evolution: Background and Principles", draft-arkko- 132 farrell-arch-model-t-redux-00 (work in progress), November 133 2020. 135 Appendix A. Acknowledgements 137 The authors would like to thank the IAB: 139 Alissa Cooper, Wes Hardaker, Ted Hardie, Christian Huitema, Zhenbin 140 Li, Erik Nordmark, Mark Nottingham, Melinda Shore, Jeff Tantsura, 141 Martin Thomson, Brian Trammel, Mirja Kuhlewind, and Colin Perkins. 143 The authors would also like to thank the participants of the IETF 144 SAAG meeting where this topic was discussed: 146 Harald Alvestrand, Roman Danyliw, Daniel Kahn Gilmore, Wes Hardaker, 147 Bret Jordan, Ben Kaduk, Dominique Lazanski, Eliot Lear, Lawrence 148 Lundblade, Kathleen Moriarty, Kirsty Paine, Eric Rescorla, Ali 149 Rezaki, Mohit Sethi, Ben Schwartz, Dave Thaler, Paul Turner, David 150 Waltemire, and Jeffrey Yaskin. 152 The authors would also like to thank the participants of the IAB 2019 153 DEDR workshop: 155 Tuomas Aura, Vittorio Bertola, Carsten Bormann, Stephane Bortzmeyer, 156 Alissa Cooper, Hannu Flinck, Carl Gahnberg, Phillip Hallam-Baker, Ted 157 Hardie, Paul Hoffman, Christian Huitema, Geoff Huston, Konstantinos 158 Komaitis, Mirja Kuhlewind, Dirk Kutscher, Zhenbin Li, Julien 159 Maisonneuve, John Mattson, Moritz Muller, Joerg Ott, Lucas Pardue, 160 Jim Reid, Jan-Frederik Rieckers, Mohit Sethi, Melinda Shore, Jonne 161 Soininen, Andrew Sullivan, and Brian Trammell. 163 The authors would also like to thank the participants of the November 164 2016 meeting at the IETF: 166 Carsten Bormann, Randy Bush, Tommy C, Roman Danyliw, Ted Hardie, 167 Christian Huitema, Ben Kaduk, Dirk Kutscher, Dominique Lazanski, Eric 168 Rescorla, Ali Rezaki, Mohit Sethi, Melinda Shore, Martin Thomson, and 169 Robin Wilton 171 Finally, the authors would like to thank numerous other people for 172 insightful comments and discussions in this space. 174 Authors' Addresses 176 Jari Arkko 177 Ericsson 178 Valitie 1B 179 Kauniainen 180 Finland 182 Email: jari.arkko@piuha.net 184 Stephen Farrell 185 Trinity College Dublin 186 College Green 187 Dublin 188 Ireland 190 Email: stephen.farrell@cs.tcd.ie