11/9/2004SPARTA: IETF 611 RPSEC THREATS STATUS Sandra Murphy

11/9/2004SPARTA: IETF 612 TYPES OF CHANGES Substantive – topics added or removed Editorial – attempts to remove inconsistencies, self-contradictions, incompleteness, etc. Usage nits and typos

11/9/2004SPARTA: IETF 613 SUBSTANTIVE The abstract and section 3 said text would talk about “capabilities” and “motivations” of the attacker. –No such text existed –But important issues – didn’t want to just delete the reference –Used text from message on mailing list – to create new Section – Threat Sources

11/9/2004SPARTA: IETF 614 SUBSTANTIVE Section 4.8 “Byzantine Failures” as attack was redundant with attacks listed in –Removed section –Used some of the text in Section Interference: Changed “The threat consequence will cease when the attacker stops overclaiming, and will totally disappear when the routing tables are converged” to “will not cease when the attacker stops overclaiming, and will totally disappear only when the routing tables are converged.” (think this was really a typo)

11/9/2004SPARTA: IETF 615 SUBSTANTIVE Misclaiming A misclaiming threat is defined as an action where an attacker is advertising its authorized control of some network resources in a way that is not intended by the authoritative network administrator. Changed to… advertising some network resources that it is authorized to control, but in a way that is not intended by the authoritative network administrator. For example, it may be advertising inappropriate link costs in an OSPF LSA. {difficult to consider attack if advertisement is based solely on router internal state – if the router says its link is down, who are we to argue?}

11/9/2004SPARTA: IETF 616 EDITORIAL OutsidersInsidersCompromised routers Subverted devicesSubverted linksUnauthorized routers Unauthorized entities: - entities outside RS - subverted entities within RS Unauthorized entities: such as attackers Masquerading routers Compromised linksSubverted routers The text talks about: Not always consistent: “Overclaiming occurs when a subverted router … Compromised routers, unauthorized routers, and masquerading routers can overclaim …. Not complete: what about faulty routers? misconfigured?

11/9/2004SPARTA: IETF 617 EDITORIAL Reduced to –“outsiders” –“Byzantine routers” faulty misconfigured subverted Changed text everywhere to conform –In some places, “subverted routers” got expanded to “outsiders or Byzantine routers”

11/9/2004SPARTA: IETF 618 EDITORIAL Section 3.1 defined threat two different ways in the same paragraph. –“a threat is defined as a motivated, capable adversary” –“In [1], a threat is defined as a potential for violation of security” {[1] is Security Glossary RFC} Stuck with definition of [1] for consistency with other terminology in the draft Moved “capable, motivated adversary” text to capabilities section

11/9/2004SPARTA: IETF 619 EDITORIAL “Overload” was overloaded term –threat consequence “the routing protocol messages themselves become a significant portion of the traffic the network carries” –threat action “a threat action whereby attackers place excess burden on legitimate routers” Renamed “overload” threat consequence to “overcontrol”