[e2e] About the primitives and their value

[Joe Touch]

Pekka Nikander wrote:
...
>> Now show us a place to publish that is NOT open to all incoming pub/sub
>> messages. ;-)
>>
>> Again, all this does is move the problem - and the opportunity for
>> attack.
> 
> Sure, I completely agree.
> 
> The trick is to move the problem as close to the potential attacker as
> possible.

There are two ways to reduce the impact of those attacks:

1) move the weakness close to the attacker, so it affects only the attacker

2) diversify the weakness and make it a strength (SOS, our own "Agile
Tunnel Protocol" system and DynaBone, etc.)

...
> The problem lies in how to distribute the "firewall information" within
> the network so that the firewall closest to the attack source can and
> will both intelligently enough filter out all or at least most of the
> unwanted traffic and pass all wanted traffic. 

That assumes trusted relationships with basically everyone EXCEPT those
who are attacking you. I don't think that's a defensible position
(either in rhetoric or in operation in the network).

> So, at least from my point of view, the really hard problem is to device
> the new "routing" infrastructure protocols in such a way that the ISPs
> benefit from collaboratively knowing which traffic is wanted (by
> someone) and which is not.

I don't think this CAN be solved by secure or protected routing. Near as
I can tell, protected routing presumes highly constrained topologies
which aren't feasible in practice. As someone recently told me, there
are too many cases where "doing the right thing" is indistinguishable
from a "routing protocol attack".

An alternate position to locking everything down (#1 above) is to
diversify routing enough that _something_ gets through (#2 above) - a
position which seems obvious, and came up in the same discussion noted
above. That's 'best effort', what the Internet was predicated on, and
IMO is a better position.

Joe


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 250 bytes
Desc: OpenPGP digital signature
Url : http://mailman.postel.org/pipermail/end2end-interest/attachments/20060809/21df5627/signature.bin