1. © 2006 NEC Corporation - Confidential age 1 November 2008 - 1 SPEERMINT Security Threats and Suggested Countermeasures draft-ietf-speermint-voipthreats-01 Saverio Niccolini, Eric Chen, Jan Seedorf, Hendrik Scholz

2. © 2006 NEC Corporation - Confidential November 2008 - 2 Goals / Scope Goals of the draft –List of security threats (specific) for SPEERMINT –Mapping of these threats to suggested countermeasures As information for implementers Also helping implementers choose proper means for addressing SPEERMINT security requirements (as defined in draft-ietf-speermint-requirements-07) Target: –Informational document for implementers

3. © 2006 NEC Corporation - Confidential November 2008 - 3 VoIP-SPECIFIC USE CASES IM/PRESENCE-SPECIFIC USE CASES VOIP-SPECIFIC REQUIREMENTS IM/PRESENCE-SPECIFIC REQUIREMENTS ARCHITECTURE MESSAGE FLOWS DNS SRV & NAPTR USE OTHER IMPLEMENTER DOCUMENTS (BCPs) TERMINOLOGY Contribution of the draft (related to SPEERMINT document flow chart) SPEERMINT Security Threats and Suggested Countermeasures: Informational Document

4. © 2006 NEC Corporation - Confidential November 2008 - 4 Security Requirements vs. concrete Solutions Security Requirements: draft-ietf-speermint-requirements-07 –This draft lists security requirements without stating concrete protocols or guidance on how to meet these requirements How to fulfill/meet the Security Requirements: draft-ietf-speermint-voipthreats-01 –This draft provides concrete protocols and solutions for meeting the requirements –As guidance for implementers who want to fulfill the security requirements for SPEERMINT –Section on security requirements (section 3) Currently only listing the security requirements Waiting for draft-ietf-speermint-requirements-07 to be finalized (IESG processing) Then addressing the requirements with text on protocols and solutions

5. © 2006 NEC Corporation - Confidential November 2008 - 5 Comments received for Version -00 at IETF 73 Minimization of SED suggested as countermeasure Included in the new -01 version Text regarding password cracking was misleading Changed Digest authentication onall requests was seen as unrealistic Removed PKI is assumed for TLS Added text

6. © 2006 NEC Corporation - Confidential November 2008 - 6 Changes since -00 version Addressed comments received (see previous slide) New threats –network discovery –unwanted requests New countermeasures –minimization of session establishment data –topology hiding Renamed / Restructured Countermeasures (see next slide) Editorial changes –Updated/removed references

7. © 2006 NEC Corporation - Confidential November 2008 - 7 Version -01: Suggested Countermeasures Suggested Countermeasures –Database Security BCPs –DNSSEC –DNS Replication –Cross-Domain Privacy Protection –Use TCP instead of UDP to deliver SIP messages –Ingress Filtering / Reverse-Path Filtering –Strong Identity Assertion –Reliable Border Element Pooling –Rate limit –Topology Hiding –Border Element Hardening –Minimization of Session Establishment Data –Encryption and Integrity Protection of Signalling Messages –Encryption and Integrity Protection of Media Stream

8. © 2006 NEC Corporation - Confidential November 2008 - 8 Current Issues / Discussion IPSec vs. TLS –IPSec is a lower-layer solution but often deployed and seen as sufficient for hop-to-hop SSP security –Requirements draft says: Even though SSPs may use lower layer security mechanisms to guarantee some of those security properties, candidate protocols for the LUF and LRF must meet the above requirements authentication/integrity/confidentiality]. –Opinions from the WG? Section on deployment (Comment received at IETF 71) –Are there other solutions besides DNSSEC which are not deployed yet?

9. © 2006 NEC Corporation - Confidential November 2008 - 9 How to proceed... We welcome any comments on this work on the mailing list –Are there additional threats missing / not considered? –Are there countermeasures missing / not considered? –Editorial changes / comments? Or contact authors directly if you have any comments: –Saverio Niccolini: saverio.niccolini@netlab.nec.de –Eric Chen: eric.chen@lab.ntt.co.jp –Jan Seedorf: jan.seedorf@nw.neclab.eu –Hendrik Scholz: hendrik.scholz@freenet.ag

10. © 2006 NEC Corporation - Confidential November 2008 - 10 History of the draft Early versions of the draft –Investigations on the security threats and attack vectors related to SPEERMINT Classification of the threats Description of instances of the threats –Objectives Identify and enumerate the SPEERMINT-specific threat vectors Help in selecting security-related requirements Input now included in draft-ietf-speermint- requirements-07 Since IETF-72, the draft has become WG item