Re: Comments on draft-ietf-rddp-security-01

On Mar 1, 2004, at 10:54 PM, Talpey, Thomas wrote:

>
> In the introduction, it seems critical to describe the scope of
>  possible damage if the trust is violated. I believe it is very
>  different depending on the resource which is the subject of
>  the trust. System-level damage should be described differently
>  from damage which merely :-) damages the application. This is
>  not a very specific recommendation, I know.
>
> I think there are differences between the trust model as described
>  here, and a privileged/nonprivileged application (at the end of
>  the Introduction). It might be worthwhile to bring these out.
>  For example, the trust model seems primarily oriented at wire-based
>  attacks, while the privileged/nonprivileged application is a local
>  matter? What interaction do these have?
>

I think the key here is advising the developer to consider the
scope of vulnerability that any successful attack would expose.

It is one thing to trust your peer if the worst thing your peer
can do is corrupt a single session that exists only to provide
services to that peer. It is quite another thing to trust your
peer if you are a kernel daemon with full root privileges to
the entire file system and access to all of physical memory.

The wide the scope of damage that your application can do when
compromised the more important it is that you *only* enable
RNIC access *precisely* to the extent required. At the opposite
extreme a daemon which fetched content for any requester and
only supported a single client per daemon instance could be
quite liberal in its exposure of its own memory.