Subject: [saag] draft-richardson-saga-onpath-attacker-02.txt...

From: Michael Richardson <[email-masked]>
Date: Mon, 16 Aug 2021 15:29:02 -0400

IETF Secretariat <[email-masked]> wrote:
    > Name: draft-richardson-saag-onpath-attacker Title: A taxonomy of
    > eavesdropping attacks State: I-D Exists Expires: 2021-08-26 (in 1 week,
    > 3 days)

What I heard three weeks ago was:

1) trying to re-TLA MITM is not desired.
2) this is all bikeshed, but maybe it's worth having that discussion once here.
3) that there are many many more attacks than just the onpath/offpath/in-the-rough.

----

I will revise the document to tend towards active onpath, passive onpath, and offpath.
I will retain the TLA MITM, and explain the historical meaning, but
deprecating it.  This is as much for "SEO" benefit as anything.

I think the document should Update RFC4949 via "Extends" (that's in 02)
(and I'll put in Updates Consideration section discussed elsewhere)

To me, the attacks that involve correlating flows and the like are a kind of
second order attack.  I would be happy to include text about it, but I'm not
sure what to say.   My understanding of this part is that a protocol could have
effective defence against an active onpath attacker for a single flow, but
that there could be some other attack that involves correlating flows.

Pull request to [email-masked]:mcr/saag-onpath-attacker.git

On the other hand, I have a lot of things to do, so I'd appreciate being told
if you think this is a waste of time.

--
Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide