Security Purposes draft-iab-identifier-comparison-00 Dave Thaler - PowerPoint PPT Presentation

Sep 07, 2022 •401 likes •510 views

Issues in Identifier Comparison for Security Purposes draft-iab-identifier-comparison-00 Dave Thaler dthaler@microsoft.com 1 Issues in Identifier Comparison for Security Purposes Identifiers are often compared for security purposes,

Issues in Identifier Comparison for Security Purposes draft-iab-identifier-comparison-00 Dave Thaler dthaler@microsoft.com 1
Issues in Identifier Comparison for Security Purposes • Identifiers are often compared for security purposes, e.g.: – Generation : • Create a “unique” value that is “different” from previously generated ids – Authentication : • Match a security principal id to get keying material • Match keying material – Authorization: • Match a resource name to get ACL • Match a security principal id in ACL 2
Example of a Simple Security Exchange 3
Types of Identifiers • Absolute: exact comparison – Ex: (binary) IPv4 address • Definite: single globally-agreed on comparison – Ex: URI scheme name is ASCII-only case-insensitive and contains no %-escapes • Indefinite: no single globally-agreed on algo. – Ex: human name 4
It’s probably worse than you think… Many identifiers are at best Definite and often turn out to be Indefinite. Example: IPv4 literals or not? And do these match or not? – 192.168.1.2 – 192.168.258 – 0xC0.0xA8.0x1.0x2 – 030052000402 Answer for all of the above: Maybe. Even the term “standard dotted decimal” is ambiguous. 5
Effect of False Positives/Negatives “Grant on match” “Deny on match” False positive “match” Elevation of Privilege Denial of Service False negative Denial of Service Elevation of Privilege • EoP almost always far worse than DoS – E.g. RFC 3986 for URIs "comparison methods are designed to minimize false negatives while strictly avoiding false positives". • Using URIs in a "deny on match" system can thus be problematic. 6
Strawman Recommendations (1/2) • Any system using both grant-on-match AND deny-on-match should not use Indefinite identifiers (Absolute ids have least chance of bugs). • Any new identifiers should specify an Absolute or Definite comparison algorithm. • If extensibility is allowed then the comparison algorithm should remain invariant, so that unrecognized extensions can be compared. 7
Strawman Recommendations (2/2) • Some issues (e.g. unrecognized extensions) can be mitigated by treating such ids as invalid (see RFC 3696). • Security protocols designed for use with other protocols should either: a) specify the comparison algorithm, and ONLY be used by protocols that use the same algorithm, or b) Support “matching algorithm” agility and use the one indicated by the using protocols. • When a collection of protocols are used together this may still mean all need to use the same algorithm. 8
Discussion • i18n-discuss@iab.org 9

Recommend

OVERVIEW OF RESIDENCY FOR TAX PURPOSES Is Residency for tax purposes a choice? NO We do not

PAYROLL SERVICES Presents: OVERVIEW OF RESIDENCY FOR TAX PURPOSES Is Residency for tax purposes a choice? NO We do not get to choose residency for tax purposes 6/11/2009 2 Objectives Understand the rules and regulations pertaining

872 views • 71 slides

NOTE: The presentation is for informational purposes only and does not constitute legal advice.

NOTE: The presentation is for informational purposes only and does not constitute legal advice. Main Federal Agencies Involved in Immigration Department of Homeland Security (DHS) U.S. Citizenship and Immigration Services (USCIS)

328 views • 30 slides

Type Qualifiers and Security This presentation will discuss two papers that use qualifiers for

Type Qualifiers and Security This presentation will discuss two papers that use qualifiers for security purposes Qualifiers are used to extend the normal C type system to provide more rigorous (and clever) type checking, both statically

443 views • 41 slides

What is network security? Friends and enemies: Alice, Bob, Trudy What is network security?

Network security Network security Foundations: what is security? cryptography Network Security Network Security authentication message integrity key distribution and certification Security in practice: Srinidhi Varadarajan

332 views • 6 slides

Disclaimer This presenta,on is for informa,on purposes only.

Bulk berths Container yard Extension area Main security gate Port access Container gate berths 1 Access road Disclaimer This presenta,on is for informa,on purposes only. Neither this presenta,on

582 views • 24 slides

Security Security as term, Possible Security violations Authentication Criteria for

BS1 WS19/20 topic-based slides Security Security as term, Possible Security violations Authentication Criteria for Trust in Computer Systems Three hearts of Windows Security DACLs A Look at Security System is secure if

988 views • 20 slides

CPSC410/611: Security Security Security Attacks Security Threats Crypto

CPSC 410 / 611 : Operating Systems CPSC410/611: Security Security Security Attacks Security Threats Crypto Authentication Examples SSL Security Threats Breach of confidentiality unauthorized access to

458 views • 18 slides

Biometrics and Security Biometrics and Security Biometrics and Security Biometrics and Security

Biometrics and Security Biometrics and Security Biometrics and Security Biometrics and Security WS 06/07 Seminar Prof. Dr.-Ing. Jana Dittmann & Dr.-Ing. Claus Vielhauer with support from Tobias Scheidat

419 views • 16 slides

1 X.800 Security Services X.800 Security Services X.800 Security Services Data integrity

Course Overview Course Requirements EECS 498-7/8 Cryptography and Network Security: www.citi.umich.edu/u/honey/security Principles and Practice (Third Edition) Computer Security Monday & Friday, 9:00 10:30 William Stallings

670 views • 19 slides

A (re)introduction to Spring Security Agenda Before Spring Security: Acegi security

A (re)introduction to Spring Security Agenda Before Spring Security: Acegi security Introducing Spring Security View layer security Whats coming in Spring Security 3 E-mail: craig@habuma.com Blog: http://www.springloaded.info

452 views • 19 slides

Network Security Network Security Srinidhi Varadarajan Network security Network security

Network Security Network Security Srinidhi Varadarajan Network security Network security Foundations: what is security? cryptography authentication message integrity key distribution and certification Security in practice:

634 views • 36 slides

Portfolios can serve multiple purposes They can support learning, play an assessment

Portfolios can serve multiple purposes They can support learning, play an assessment role, or support employment. PORTFOLIOS Professional Professional Purposes Educational Purposes Purposes Educational Purposes

262 views • 24 slides

Security Overview Security Goals The Attack Space Security Mechanisms

CSCE Intro to Computer Systems Security Security Overview Security Goals The Attack Space Security Mechanisms Introduction to Cryptography Authentication Authorization Confidentiality Case Studies Security

472 views • 20 slides

SECURITY TESTING Towards a safer web world AGENDA 1. 3 WS OF SECURITY TESTING 2. SECURITY

SECURITY TESTING Towards a safer web world AGENDA 1. 3 WS OF SECURITY TESTING 2. SECURITY TESTING CONCEPTS 3. SECURITY TESTING TYPES 4. TOP 10 SECURITY RISKS Few Security Breaches Date: 2013-14 September 2016, while in negotiations to

404 views • 18 slides

The Paycheck Protection Program under the Coronavirus Aid, Relief, and Economic Security Act

4/2/2020 The Paycheck Protection Program under the Coronavirus Aid, Relief, and Economic Security Act What Broker-Owners Need to Know 2 April 2020 For Informational Purposes Only and Broker-Owner Edu-tainment 1 Disclosures Atrox Partners,

145 views • 13 slides

Security Security with Distributed Systems Why Security? The need for security mechanisms in

Security Security with Distributed Systems Why Security? The need for security mechanisms in distributed systems arises from the desire to share resources Resources must be protected against unauthorized access, as enemies (attackers)

1.16k views • 67 slides

Security Overview Security Goals The Attack Space Security Mechanisms

CPSC 410/611 Operating Systems Security Security Overview Security Goals The Attack Space Security Mechanisms Introduction to Cryptography Authentication Authorization Confidentiality Case Studies

419 views • 19 slides

International and Global Security 1 Peer Discussion What is security? 2 International

International and Global Security 1 Peer Discussion What is security? 2 International Security What is security? Freedom from threats to core values? Contestation over referent object: Individual? State? System? How is security achieved?

715 views • 11 slides

Security 101 Definition of Information Security Information security is the protection of

Computing Services Information Security Office Security 101 Definition of Information Security Information security is the protection of information and systems from unauthorized access, disclosure, modification, destruction or disruption. The

469 views • 22 slides

Security Update Security Plans Our Security plans are For Official Use Only, Safety

Security Update Security Plans Our Security plans are For Official Use Only, Safety Sensitive Information Not for public or media release F.S. 119.071. Required by law, rule and regulation: Homeland Security Directive 5 and 8.

393 views • 11 slides

Accugas Delivering gas July 2014 Disclaimer This presentation is for information purposes only

Accugas Delivering gas July 2014 Disclaimer This presentation is for information purposes only and does not constitute an offer to sell or the solicitation of an offer to buy any security and shall not constitute an offer, solicitation or sale

385 views • 10 slides

Com puter Security Part One Security as a subject Security is an old problem in the

Com puter Security Part One Security as a subject Security is an old problem in the computing world, and are parallel to even older problems outside computing Required level of security is always related to what you protect

237 views • 23 slides

Introduction to Security Comm. Security Strategy Summary ITS335: IT Security Sirindhorn

ITS335 Intro. to Security Concepts Threats, Attacks, Assets Introduction to Security Comm. Security Strategy Summary ITS335: IT Security Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 2

965 views • 34 slides

Effective Security for the Post-compliance Era Security Awareness and Training for Security

Effective Security for the Post-compliance Era Security Awareness and Training for Security Specialists M. ANGELA SASSE, RUHR UNIVERSITY BOCHUM & UCL The problem MENSCHLICH WELTOFFEN LEISTUNGSSTARK 2 ENISA Report December 2018

362 views • 33 slides