Skip to content

Remove slow retrieval attacks from protections #111

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 2 commits into from
Sep 29, 2020
Merged

Remove slow retrieval attacks from protections #111

merged 2 commits into from
Sep 29, 2020

Conversation

joshuagl
Copy link
Member

@joshuagl joshuagl commented Sep 8, 2020 •
edited
Loading

I think we should remove slow retrieval attacks from 1.5.2. Goals to protect against specific attacks. I've included details in the commit message but the tl;dr is that:

  1. AFAICT nothing in the specification protects against these attacks
  2. implementing protections against slow retrieval attacks has a high complexity for implementers which is not met by sufficient need
  3. ownership of the network/download stack, in order to protect against slow retrieval attacks, is not something that clients are willing to give up (i.e. pip has thoroughly tested download code that they'd like to keep using)

@trishankatdatadog
Copy link
Member

I have no strong opinions either way. It's certainly one of the more theoretical attacks.

@mnm678
Copy link
Collaborator

mnm678 commented Sep 8, 2020

This makes sense to me. Slow retrieval attacks may be better suited for the proposed companion documentation as it is more of an implementation concern.

lukpueh
lukpueh approved these changes Sep 29, 2020
View reviewed changes
Copy link
Member

@lukpueh lukpueh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Should we also remove mentions of slow retrieval attack on the website and in python-tuf docs?

@joshuagl @lukpueh
Remove slow retrieval attacks from protections
f9122f1 
Section 1.5.2. Goals to protect against specific attacks lists the types
of attacks on package managers which TUF protects against.

For slow retrieval attacks, nothing in the specification provides any
protections against this class of attack. For each other attack type there
are protections within the specification that help prevent those attacks
from being successful.

Therefore, protecting against slow retrieval attacks becomes an aspiration
for implementations and implementers are left to their own devices to
determine how best to protect against these attacks.

Furthermore, implementing protections against slow retrieval attacks is a
complex task for implementations which may be contrary to the desires of
systems choosing to integrate TUF. Many existing software update systems
choosing to integrate TUF will have their own tested network/download
stack that they will not replace lightly.

Finally, AFAICT base on a quick perusal of go-tuf and Tough, only the
reference implementation has attempted to implement protection against
slow retrieval attacks. The reference implementation does not currently
protect against slow retrieval attacks.

Signed-off-by: Joshua Lock <[email protected]>
@joshuagl @lukpueh
Bump patch version and modified date
f5aee98 
Signed-off-by: Joshua Lock <[email protected]>
@lukpueh lukpueh force-pushed the joshuagl/rm-slow-retrieval branch from d908c65 to f5aee98 Compare September 29, 2020 10:00
@lukpueh
Copy link
Member

lukpueh commented Sep 29, 2020

I took the liberty to rebase on the just updated (#117) master and update date/version header.

@lukpueh lukpueh merged commit 7c9c173 into theupdateframework:master Sep 29, 2020
@joshuagl joshuagl deleted the joshuagl/rm-slow-retrieval branch September 30, 2020 09:18
joshuagl added a commit to joshuagl/theupdateframework.io that referenced this pull request Sep 30, 2020
@joshuagl
Remove mention of slow retrieval attacks
5b10c89 
Slow retrieval attacks were removed from the specification in v1.0.7 of
the TUF specification because the specification itself does not provide
mechanisms to protect against this type of attack:

theupdateframework/specification#111

Signed-off-by: Joshua Lock <[email protected]>
@joshuagl joshuagl mentioned this pull request Sep 30, 2020
Merged
@joshuagl
Copy link
Member Author

LGTM. Should we also remove mentions of slow retrieval attack on the website and in python-tuf docs?

Definitely. Website PR opened theupdateframework/theupdateframework.io#15 and reference implementation PR is WIP theupdateframework/python-tuf#1156

@trishankatdatadog
Copy link
Member

On second thought, we may want to reinstate this in the future, but yes: there is currently nothing in the specification or reference implementation that specifies precisely how to do it. I am starting a conversation on the CNCF Slack channel for more high-bandwidth discussion. Will post findings here later.

@joshuagl
Copy link
Member Author

joshuagl commented Oct 1, 2020

Discussion thread is at https://cloud-native.slack.com/archives/C8NMD3QJ3/p1601477330050100

@trishankatdatadog trishankatdatadog mentioned this pull request Oct 1, 2020
Open
MVrachev added a commit to MVrachev/tuf that referenced this pull request Oct 19, 2020
@MVrachev
Remove test_slow_retrieval expected failure test
54cb2ef 
Slow retrievals have been removed from the specification and
soon it will be removed from the tuf reference implementation
as a whole.
This means that the chances of making this test useful are close
to 0 if not none.

For reference:
- theupdateframework/specification#111
- theupdateframework#1156

Signed-off-by: Martin Vrachev <[email protected]>
MVrachev added a commit to MVrachev/tuf that referenced this pull request Oct 19, 2020
@MVrachev
Remove test_slow_retrieval expected failure test
7f2d30c 
Slow retrievals have been removed from the specification and
soon it will be removed from the tuf reference implementation
as a whole.
This means that the chances of making this test useful are close
to 0 if not none.

For reference:
- theupdateframework/specification#111
- theupdateframework#1156

Signed-off-by: Martin Vrachev <[email protected]>
MVrachev added a commit to MVrachev/tuf that referenced this pull request Oct 22, 2020
@MVrachev
Remove test_slow_retrieval expected failure test
37d336b 
Remove the test with mode 2 ('mode_2': During the download process,
the server blocks the download by sending just several characters
every few seconds.) from test_slow_retrieval.

This test is marked as "expected failure" with the purpose of
rewriting it one day, but slow retrievals have been removed from
the specification and soon it will be removed from the tuf
reference implementation as a whole.
That means that the chances of making this test useful are close
to 0 if not none.

The other test (with mode 1) in test_slow_retrieval is not removed.

For reference:
- theupdateframework/specification#111
- theupdateframework#1156

Signed-off-by: Martin Vrachev <[email protected]>
MVrachev added a commit to MVrachev/tuf that referenced this pull request Oct 22, 2020
@MVrachev
Remove test_slow_retrieval expected failure test
d57353f 
Remove the test with mode 2 ('mode_2': During the download process,
the server blocks the download by sending just several characters
every few seconds.) from test_slow_retrieval.

This test is marked as "expected failure" with the purpose of
rewriting it one day, but slow retrievals have been removed from
the specification and soon it will be removed from the tuf
reference implementation as a whole.
That means that the chances of making this test useful are close
to 0 if not none.

The other test (with mode 1) in test_slow_retrieval is not removed.

For reference:
- theupdateframework/specification#111
- theupdateframework#1156

Signed-off-by: Martin Vrachev <[email protected]>
MVrachev added a commit to MVrachev/tuf that referenced this pull request Oct 28, 2020
@MVrachev
Remove test_slow_retrieval expected failure test
06cd262 
Remove the test with mode 2 ('mode_2': During the download process,
the server blocks the download by sending just several characters
every few seconds.) from test_slow_retrieval.

This test is marked as "expected failure" with the purpose of
rewriting it one day, but slow retrievals have been removed from
the specification and soon it will be removed from the tuf
reference implementation as a whole.
That means that the chances of making this test useful are close
to 0 if not none.

The other test (with mode 1) in test_slow_retrieval is not removed.

For reference:
- theupdateframework/specification#111
- theupdateframework#1156

Signed-off-by: Martin Vrachev <[email protected]>
MVrachev added a commit to MVrachev/tuf that referenced this pull request Oct 28, 2020
@MVrachev
Remove test_slow_retrieval expected failure test
d8363d6 
Remove the test with mode 2 ('mode_2': During the download process,
the server blocks the download by sending just several characters
every few seconds.) from test_slow_retrieval.

This test is marked as "expected failure" with the purpose of
rewriting it one day, but slow retrievals have been removed from
the specification and soon it will be removed from the tuf
reference implementation as a whole.
That means that the chances of making this test useful are close
to 0 if not none.

The other test (with mode 1) in test_slow_retrieval is not removed.

For reference:
- theupdateframework/specification#111
- theupdateframework#1156

Signed-off-by: Martin Vrachev <[email protected]>
MVrachev added a commit to MVrachev/tuf that referenced this pull request Oct 28, 2020
@MVrachev
Remove test_slow_retrieval expected failure test
9cff280 
Remove the test with mode 2 ('mode_2': During the download process,
the server blocks the download by sending just several characters
every few seconds.) from test_slow_retrieval.

This test is marked as "expected failure" with the purpose of
rewriting it one day, but slow retrievals have been removed from
the specification and soon it will be removed from the tuf
reference implementation as a whole.
That means that the chances of making this test useful are close
to 0 if not none.

The other test (with mode 1) in test_slow_retrieval is not removed.

For reference:
- theupdateframework/specification#111
- theupdateframework#1156

Signed-off-by: Martin Vrachev <[email protected]>
MVrachev added a commit to MVrachev/tuf that referenced this pull request Nov 3, 2020
@MVrachev
Remove test_slow_retrieval expected failure test
f3c04cb 
Remove the test with mode 2 ('mode_2': During the download process,
the server blocks the download by sending just several characters
every few seconds.) from test_slow_retrieval.

This test is marked as "expected failure" with the purpose of
rewriting it one day, but slow retrievals have been removed from
the specification and soon it will be removed from the tuf
reference implementation as a whole.
That means that the chances of making this test useful are close
to 0 if not none.

The other test (with mode 1) in test_slow_retrieval is not removed.

For reference:
- theupdateframework/specification#111
- theupdateframework#1156

Signed-off-by: Martin Vrachev <[email protected]>
MVrachev added a commit to MVrachev/tuf that referenced this pull request Nov 4, 2020
@MVrachev
Remove test_slow_retrieval expected failure test
304b2ae 
Remove the test with mode 2 ('mode_2': During the download process,
the server blocks the download by sending just several characters
every few seconds.) from test_slow_retrieval.

This test is marked as "expected failure" with the purpose of
rewriting it one day, but slow retrievals have been removed from
the specification and soon it will be removed from the tuf
reference implementation as a whole.
That means that the chances of making this test useful are close
to 0 if not none.

The other test (with mode 1) in test_slow_retrieval is not removed.

For reference:
- theupdateframework/specification#111
- theupdateframework#1156

Signed-off-by: Martin Vrachev <[email protected]>
MVrachev added a commit to MVrachev/tuf that referenced this pull request Nov 11, 2020
@MVrachev
Remove test_slow_retrieval expected failure test
e391341 
Remove the test with mode 2 ('mode_2': During the download process,
the server blocks the download by sending just several characters
every few seconds.) from test_slow_retrieval.

This test is marked as "expected failure" with the purpose of
rewriting it one day, but slow retrievals have been removed from
the specification and soon it will be removed from the tuf
reference implementation as a whole.
That means that the chances of making this test useful are close
to 0 if not none.

The other test (with mode 1) in test_slow_retrieval is not removed.

For reference:
- theupdateframework/specification#111
- theupdateframework#1156

Signed-off-by: Martin Vrachev <[email protected]>
MVrachev added a commit to MVrachev/tuf that referenced this pull request Nov 13, 2020
@MVrachev
Remove test_slow_retrieval expected failure test
10157c3 
Remove the test with mode 2 ('mode_2': During the download process,
the server blocks the download by sending just several characters
every few seconds.) from test_slow_retrieval.

This test is marked as "expected failure" with the purpose of
rewriting it one day, but slow retrievals have been removed from
the specification and soon it will be removed from the tuf
reference implementation as a whole.
That means that the chances of making this test useful are close
to 0 if not none.

The other test (with mode 1) in test_slow_retrieval is not removed.

For reference:
- theupdateframework/specification#111
- theupdateframework#1156

Signed-off-by: Martin Vrachev <[email protected]>
MVrachev added a commit to MVrachev/tuf that referenced this pull request Nov 13, 2020
@MVrachev
Remove test_slow_retrieval expected failure test
592a947 
Remove the test with mode 2 ('mode_2': During the download process,
the server blocks the download by sending just several characters
every few seconds.) from test_slow_retrieval.

This test is marked as "expected failure" with the purpose of
rewriting it one day, but slow retrievals have been removed from
the specification and soon it will be removed from the tuf
reference implementation as a whole.
That means that the chances of making this test useful are close
to 0 if not none.

The other test (with mode 1) in test_slow_retrieval is not removed.

For reference:
- theupdateframework/specification#111
- theupdateframework#1156

Signed-off-by: Martin Vrachev <[email protected]>
@mnm678 mnm678 mentioned this pull request Nov 20, 2020
Closed
@lukpueh lukpueh mentioned this pull request Jan 12, 2021
Merged
3 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@lukpueh lukpueh lukpueh approved these changes

@mnm678 mnm678 mnm678 approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@joshuagl @trishankatdatadog @mnm678 @lukpueh