Subject: Re: [RTG-DIR] [Detnet] Rtgdir last call review of draft-ietf-detnet-security-10

From: Stewart Bryant <[email-masked]>
Date: Thu, 6 Aug 2020 13:51:35 +0100

> ---
> 
> It would be nice to avoid the term "man-in-the-middle" (and coresponding
> "MITM") in favour of the term "on-path attacker". It is less problematic
> as a term, and no less accurate.
> 
> Although "man-in-the-middle" is well established, I think you could
> easily avoid it and if you feel necessary you could use "An on-path
> attacker (formerly known as a man-in-the-middle) ..."

I sort of understand why you want to change MITM, although given that the man you have in mind is evil I am not sure whether it is that objectionable in this context. However I am not sure on-path is the right term. MITM normally implies an entity that can modify traffic in flight, whereas an on path attacker may simply be an observer.

Maybe AITM (attacker ....) would be a better gender neutral term.

Stewart

---

From: Eric Gray <[email-masked]>
Date: Thu, 6 Aug 2020 13:05:14 +0000

Stewart,

	Actually, in addition to the many things that are strange about this entire conversation, your observation about the "thing in the middle" (I mean, let's face it, the "entity" in the middle - EITM? - has been gender-neutral for a long time, given that any human participation in the role could be detected by an idiot) being necessarily _active_ is not quite correct.

	It seems to me to be quite reasonable that the middle position could as easily be used to passively collect information for use in other activities - including a few fairly well known attacks.

--
Eric

-----Original Message-----
From: rtg-dir <[email-masked]> On Behalf Of Stewart Bryant
Sent: Thursday, August 6, 2020 8:52 AM
To: Adrian Farrel <[email-masked]>
Cc: [email-masked]; [email-masked]; [email-masked]
Subject: Re: [RTG-DIR] [Detnet] Rtgdir last call review of draft-ietf-detnet-security-10

> "MITM") in favour of the term "on-path attacker". It is less 
> problematic as a term, and no less accurate.
> 

Stewart

---

From: Stewart Bryant <[email-masked]>
Date: Thu, 6 Aug 2020 18:12:46 +0100

We are talking about the threats in DN. 

I think we should be focusing on the things that are special to DN which is a technology that adds certain properties to a general network. I assume the protection of the general network using the normal techniques is a given.

Passively looking at the contents is about privacy and technical surveillance to intervene more effectively.

Privacy obviously applies to a general network, and I take it as read that we protect against this. However this document is about DN, and I cannot see what the privacy concerns are about the DN specifics.

- Stewart

> On 6 Aug 2020, at 14:05, Eric Gray <[email-masked]> wrote:
> 
> Stewart,
>

---

From: Eric Gray <[email-masked]>
Date: Thu, 6 Aug 2020 18:16:06 +0000

Stewart,

	I am going to assume that you mean "DetNet" when you refer to "DN" (maybe I'm wrong?).

	I am not certain that your "active attacker" assumption is correct even in this limited case, but you were responding on the subject of "gender neutrality" and whether or not it is appropriate to use "MITM" (presumably in general).

	That topic is no longer in the realm of "DetNet specific."  So your response should probably not be written (or read) as if it were.

	In your own words, however, one reason for passive listening is "technical surveillance to intervene more effectively" - which would seem to apply to DetNet at least as much as to anything else.

	This is not necessarily a generic privacy concern, as a passive MITM could be waiting for some specific activity (or activities) to occur in what would clearly be a "special class" of communications (such as DetNet would be).

	As I implied in a separate discussion, a MITM active attacker is rather easy to detect and deal with - unless it targets a specific subset of users or applications in unpredictable ways.  If it remains passive, the only way to detect it is from information leakage that would otherwise be unexplainable.

	If a malicious actor has other ways to perpetrate an attack, a passive MITM could be used to select targets, or select timing, and otherwise remain undetected over a long period of time.

	Presumably, DetNet traffic is self-announced "important" traffic.  If this does not increase its vulnerability to active or passive MITM hazards, then it would be good to be assured of that.

--
Eric

--
Eric

-----Original Message-----
From: Stewart Bryant <[email-masked]> 
Sent: Thursday, August 6, 2020 1:13 PM
To: Eric Gray <[email-masked]>
Cc: Stewart Bryant <[email-masked]>; Adrian Farrel <[email-masked]>; [email-masked]; [email-masked]; [email-masked]
Subject: Re: [RTG-DIR] [Detnet] Rtgdir last call review of draft-ietf-detnet-security-10
Importance: High

- Stewart

---

From: "Adrian Farrel" <[email-masked]>
Date: Fri, 7 Aug 2020 18:10:22 +0100

I can't decide whether to get into this or not 😊

My review said, "It would be nice to avoid," not, "You must avoid."
The review is principally for the AD, and they will tell you whether you need to action this.
I made a constructive suggestion of an alternative phrase, but you are allowed to choose others.

The thing about the term "man-in-the-middle" is not that it is directly making a specific man appear evil, it is that it associates the word "man" with the concept "evil" and therefore subtly changes the long-term perception of "man". There is, in fact, nothing about this type of attack that is specific to a man, and not all attackers are men, nor are all men attackers.

This is a minor issue for me, and (to some extent) I wanted to experiment with draft-knodel-terminology to see what reaction it would get if the changes it suggests were made as a request rather than as an order.

Cheers,
Adrian

-----Original Message-----
From: Stewart Bryant <[email-masked]> 
Sent: 06 August 2020 13:52
To: Adrian Farrel <[email-masked]>
Cc: [email-masked]; [email-masked]; [email-masked]
Subject: Re: [Detnet] Rtgdir last call review of draft-ietf-detnet-security-10

Stewart