Subject: Re: [core] Review of draft-hartke-core-e2e-security-reqs-01

From: "weigengyu" <[email-masked]>
Date: Wed, 14 Sep 2016 15:21:15 +0800

Hi,

Just one question.
Is it required to refer to documentations on threats of HTTP proxies?

Regards,

Gengyu WEI
Network Technology Center
School of Computer
Beijing University of Posts and Telecommunications
-----原始邮件----- 
From: Jim Schaad
Sent: Thursday, August 04, 2016 12:44 AM
To: 'Klaus Hartke'
Cc: [email-masked] ; [email-masked]
Subject: Re: [core] Review of draft-hartke-core-e2e-security-reqs-01

> -----Original Message-----
> From: Klaus Hartke [mailto:[email-masked]]
> Sent: Wednesday, August 03, 2016 8:23 AM
> To: Jim Schaad <[email-masked]>
> Cc: [email-masked]; [email-masked] WG
> <[email-masked]>
> Subject: Re: [core] Review of draft-hartke-core-e2e-security-reqs-01
>
> Hi Jim,
>
> thanks a lot for your review. Comments inline below.
>
> Klaus
>
>
> Jim Schaad wrote:
>
> > 2. Section 2.1.1 - Should "client receives a response" include
> >
> >     * (Threat ?) The proxy returns a stale or outdated response based
> > on data it previously obtained from the origin server or some fourth 
> > party.
> >
> >                I'm thinking of both out of date caches and poisoned 
> > caches.
> > Note that these are valid from a security point of view, but not 'fresh'
>
> This is a part of (Threat 1:) The proxy spoofs a response.
>
> In the mitigation section (2.1.1.1.) we define that a response is valid 
> from a
> security point of view only if it is fresh.
>
> (We use the term "authentic" instead of "valid" though, because "valid" is
> already used in the context of cache validation.)
>
> I've expanded the text with your suggestion:
>
>       *  (Threat 1:) The proxy spoofs a response.  For example, the
>          proxy could return a stale or outdated response based on data
>          it previously obtained from the server or some fourth party, or
>          could craft an illicit response itself.
>

My problem with this is that I view a spoof as different.  To me a spoof 
implies the attempt to create a new message that will pass muster as oppose 
to doing something like a replay.  It would probably be better to use a 
different term.  I'll try and remember to ponder on this.

Jim

_______________________________________________
core mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/core

---

From: Jim Schaad <[email-masked]>
Date: Sat, 17 Sep 2016 14:37:33 -0700

I am not sure that I follow why you believe that an HTTP proxy document should be referenced.  The problem space might be similar but there are some very distinct differences around things like caching that are done by components other than HTTP proxies.

jim

> From: weigengyu [mailto:[email-masked]]
> Sent: Wednesday, September 14, 2016 12:21 AM
> To: Jim Schaad <[email-masked]>; 'Klaus Hartke' <[email-masked]>
> Cc: [email-masked]; [email-masked]