IETF-88 Update: Pervasive Monitoring Jari Arkko Russ - - PowerPoint PPT Presentation

▶
ietf 88 update pervasive monitoring
SMART_READER_LITE
LIVE PREVIEW

IETF-88 Update: Pervasive Monitoring Jari Arkko Russ - - PowerPoint PPT Presentation

Dec 19, 2022 279 likes •408 views

IETF-88 Update: Pervasive Monitoring Jari Arkko Russ Housley IETF Chair IAB Chair I. IETF-88 hot topics II. The pervasive monitoring problem III. What is the IETF doing about it? 1 Monday, November 18,

slide-1
SLIDE 1

IETF-88 Update: Pervasive Monitoring

Jari Arkko Russ Housley

IETF Chair IAB Chair

  • I. IETF-88 hot topics
  • II. The pervasive monitoring problem
  • III. What is the IETF doing about it?

1

Monday, November 18, 13

slide-2
SLIDE 2

Hot Topics at IETF-88

  • Pervasive monitoring
  • HTTP 2.0
  • TLS 1.3
  • Codec choices for WebRTC
  • Evolution of transport protocols

2

Monday, November 18, 13

slide-3
SLIDE 3

Pervasive Monitoring - Scope for Discussion

  • IETF is not a forum for political discussion
  • Problem is actually wider issue in the world
  • But we MUST understand what dangers in

general face Internet traffic

  • And we SHOULD have an idea how Internet

technology can better support security and privacy

3

Monday, November 18, 13

slide-4
SLIDE 4

It Is an Attack from the Perspective of Internet Protocols

  • ... or indistinguishable from attacks
  • Retrieved information could be used for good
  • r bad; consider thieves stealing passwords
  • Anything indistinguishable from an attack must

be considered an attack

4

Monday, November 18, 13

slide-5
SLIDE 5

Likely Attack Vectors

  • Unprotected communications (duh!)
  • Direct access to the peer
  • Direct access to keys (e.g., lavabit?)
  • Third parties (e.g., fake certs)
  • Implementation backdoors (e.g., RNGs)
  • Vulnerable standards (e.g., Dual_EC_DBRG)

5

Monday, November 18, 13

slide-6
SLIDE 6

Vulnerable Standards?

  • Bad random number generators (case

Dual_EC_DBRG withdrawn by NIST)

  • Weak crypto (case RC4 in TLS)
  • Some claims about other vulnerabilities in

IETF standards (IPsec) and elsewhere but personally we believe this to be unlikely

6

Monday, November 18, 13

slide-7
SLIDE 7

What Can the Engineers Do?

  • Technology may help - to an extent - but

does not help with communications to an untrusted peer

  • Prevent some attacks, make getting caught

more likely, shift attacks from wholesale to targeted, ...

  • We need to do and be seen doing as much

as we can - this is about the security of the Internet - and the time window is now

7

Monday, November 18, 13

slide-8
SLIDE 8

Some Directions for Protection

  • Unprotected communications - protect them!
  • Vulnerable standards - public review,

decommissioning old algorithms, additional review

  • Implementation backdoors - diversity, open

source, review

8

Monday, November 18, 13

slide-9
SLIDE 9

What Is the IETF Doing?

  • Discuss the topic - openly
  • PERPASS, Plenary, IAB WS, WGs, ...
  • Work on the problem: threats, potential

solutions...

  • A list at http://down.dsg.cs.tcd.ie/misc/perpass.txt
  • Specific proposals: TLS algorithms & PFS
  • Ongoing efforts with impacts: HTTP 2.0, TLS 1.3
  • Bring together the different stakeholders to

discuss the different solutions

9

Monday, November 18, 13

slide-10
SLIDE 10

Some High-Interest Efforts

  • Various services turning on TLS far more in recent

years than before -- this trend will now accelerate

  • Algorithm clean-up -- implementations &

specifications

  • Security to be on by default for HTTP 2.0?
  • What about DNS?

10

Monday, November 18, 13

slide-11
SLIDE 11

Further Reading & Watching

  • Watch Bruce Schneier and others speak about the

pervasive monitoring problem & technical solutions: http://www.ietf.org/live

  • Join the IETF “perpass” mailing list: https://

www.ietf.org/mailman/listinfo/perpass

  • Join various working group mailing lists:
  • APPSAWG: http://tools.ietf.org/wg/appsawg
  • HTTPBIS: http://tools.ietf.org/wg/httpbis
  • TLS: http://tools.ief.org/wg/tls

11

Monday, November 18, 13

slide-12
SLIDE 12

Thank You

12

Monday, November 18, 13