RFC 7435

Opportunistic Security: Some Protection Most of the Time

📅 published December 2014, from ietf

RFC 7435: Opportunistic Security: Some Protection Most of the Time 🦋

  • Who wrote it: V. Dukhovni from Two Sigma 💅
  • Category: Informational, which means it's published for info and isn't a Standards Track spec 📚
  • Date: December 2014 🎀
  • ISSN: 2070-1721
  • Obsoletes / updates: the header doesn't list anything it obsoletes or updates ✨

Abstract 🌸

Okay bestie, so this doc defines the concept of "Opportunistic Security" for communications protocols. The big idea is that OS protocols encrypt even when they can't authenticate, and they authenticate when they can. That's how we get rid of the barriers stopping encryption from being everywhere on the Internet. It's giving "a little protection beats none" energy 🫶

Status of This Memo 💜

This doc isn't an Internet Standards Track spec. It's just published for info 🧚

It's an IETF product and represents the consensus of the IETF community. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG). Not every doc the IESG approves is a candidate for any level of Internet Standard, so see Section 2 of RFC 5741 for that 🔥

For the current status, any errata, and how to send feedback, check http://www.rfc-editor.org/info/rfc7435 📬

Copyright (c) 2014 IETF Trust and the persons identified as the document authors. All rights reserved ✨

This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they were in effect on the publication date. Please read those carefully, because they spell out your rights and restrictions for this document 📜 Any Code Components pulled out of this doc must include Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions. They're provided without warranty, as described in the Simplified BSD License 💖

Table of Contents 🍓

1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
  1.1.  Background  . . . . . . . . . . . . . . . . . . . . . . .   2
  1.2.  A New Perspective . . . . . . . . . . . . . . . . . . . .   3
2.  Terminology . . . . . . . . . . . . . . . . . . . . . . . . .   5
3.  Opportunistic Security Design Principles  . . . . . . . . . .   5
4.  Example: Opportunistic TLS in SMTP  . . . . . . . . . . . . .   8
5.  Operational Considerations  . . . . . . . . . . . . . . . . .   8
6.  Security Considerations . . . . . . . . . . . . . . . . . . .   9
7.  References  . . . . . . . . . . . . . . . . . . . . . . . . .  10
  7.1.  Normative References  . . . . . . . . . . . . . . . . . .  10
  7.2.  Informative References  . . . . . . . . . . . . . . . . .  10
Acknowledgements  . . . . . . . . . . . . . . . . . . . . . . . .  11
Author's Address  . . . . . . . . . . . . . . . . . . . . . . . .  11

1. Introduction ✨

1.1. Background 🕰️

Historically, Internet security protocols have gone for comprehensive "all or nothing" crypto protection against both passive and active attacks. With each peer, these protocols either give you full protection or total failure to communicate (hard fail) 💀 Because of that, operators often turn these security protocols off when users are struggling to connect, which downgrades everything to cleartext transmission 🙈

Protection against active attacks requires authentication. Being able to authenticate any potential peer on the Internet means you need an authentication mechanism that covers all of those peers. No IETF standard for authentication scales the way it needs to, or has been deployed widely enough to meet that requirement 😭

The Public Key Infrastructure (PKI) model that browsers use to authenticate web servers (often called the "Web PKI") costs a lot and is a pain to manage, so it hasn't been used as much as it could be. There are so many Certification Authorities (CAs), and not everyone is willing to trust all of them, so the communicating parties don't always agree on a mutually trusted CA. Without a mutually trusted CA, authentication fails, and protocols that require authentication end up with communications failure 💔 Operational problems make this worse. A common one is site operators forgetting to renew expiring certificates on time. In interactive Web PKI apps, security warnings pop up all the time, so end users learn to just ignore security problems. Or site admins decide the maintenance isn't worth it and offer a cleartext-only service instead 🙄

The trust-on-first-use (TOFU) approach assumes that an unauthenticated public key obtained on first contact (and kept for future use) will be good enough to secure future communication. TOFU-based protocols don't protect against an attacker who can hijack that first contact, and they need more care from the end user whenever systems update their crypto keys. TOFU can also make it hard to tell routine key management apart from a malicious attack 👀

DNS-Based Authentication of Named Entities (DANE) [RFC6698] defines a way to distribute public keys bound to DNS names. It can be an alternative to the Web PKI. DANE has to be used together with DNSSEC [RFC4033]. When this was written, DNSSEC wasn't deployed widely enough for DANE to authenticate all potential peers. So protocols that require authenticated communication can't yet generally do that via DANE (at the time of writing) 🧐

The lack of a global key management system means that for many protocols, only a minority of communications sessions can be predictably authenticated. When protocols only offer a choice between authenticated-and-encrypted communication or no protection at all, most traffic ends up going in cleartext. Since most traffic isn't encrypted, pervasive monitoring is easier, because it becomes cost-effective, or at least not cost-prohibitive (see [RFC7258] for more detail) 🚨

For encryption to be used more broadly, authentication needs to be optional. Encryption defends against pervasive monitoring and other passive attacks. Even unauthenticated, encrypted communication (defined below) is better than cleartext 🫶

1.2. A New Perspective 🔮

This doc describes a change in perspective. Until now, protocol designers have treated protection against both passive and active attacks as the default, and anything short of that as "degraded security" or a "fallback". The new view is that, without specific knowledge of peer capabilities (or explicit configuration or a direct request from the application), the default protection is no protection, and anything more than that is an improvement 🌟

"Opportunistic Security" (OS) is defined as using cleartext as the baseline communication security policy, with encryption and authentication negotiated and applied to the communication when they're available 🦋

Cleartext, not comprehensive protection, is the default baseline. An OS protocol isn't falling back from comprehensive protection when not all peers support it. Instead, OS protocols aim to use the maximum protection that's available. (At some point, for a particular application or protocol, all but a negligible fraction of peers might support encryption. At that point, the baseline could be raised from cleartext to always requiring encryption, and only authentication would have to be done opportunistically.) 🧠

To get widespread adoption, OS has to support incremental deployment. Incremental deployment means security capabilities will vary from peer to peer, maybe for a very long time. OS protocols will try to set up encrypted communication whenever both parties can do it, and authenticated communication if that's possible too. So an OS protocol might give you communication that's authenticated and encrypted, unauthenticated but encrypted, or cleartext. That last outcome happens if not all parties support encryption (or if an active attack makes it look that way) 🎭

When less than complete protection is negotiated, there's no need to prompt the user with "your security may be degraded, please click OK" dialogs. The negotiated protection is as good as can be expected. Even if it isn't comprehensive, it's often better than the traditional outcomes of "no protection" or "communications failure" 🙌

OS isn't a substitute for authenticated, encrypted communication when policy already requires it (that is, by configuration or a direct request from the application), or when it's otherwise required to access a particular resource. Basically, OS is used when you'd otherwise settle for cleartext. OS protocols never override explicit security policies. A security administrator can write policies that override OS. For example, a policy might require authenticated, encrypted communication, unlike the default OS security policy 🔒

In this doc, "opportunistic" has a positive connotation. Based on advertised peer capabilities, an OS protocol uses as much protection as possible. The adjective "opportunistic" applies to the adaptive choice of security mechanisms peer by peer. Once that choice is made for a given peer, OS looks pretty similar to other designs that happen to use the same set of mechanisms 💅

The rest of this doc defines the important terms, lays out the OS design principles, and gives an example of an OS design for communication between mail relays 📮

2. Terminology 📖

Trust on First Use (TOFU): In a protocol, TOFU means accepting and storing a public key or credential tied to an asserted identity, without authenticating that assertion. Later communication that's authenticated using the cached key or credential is secure against a MiTM attack, as long as such an attack didn't succeed during the vulnerable initial communication. The SSH protocol [RFC4251] in its commonly deployed form uses TOFU. The phrase "leap of faith" [RFC4949] is sometimes used as a synonym 🧚

Authenticated, encrypted communication: Encrypted communication that uses a session establishment method where at least the initiator (or client) authenticates the identity of the acceptor (or server). This is required to protect against both passive and active attacks. Mutual authentication, where the server also authenticates the client, helps mitigate active attacks when the client and server roles change during a single session ✨

Unauthenticated, encrypted communication: Encrypted communication that uses a session establishment method that doesn't authenticate the identities of the peers. Usually, this means the initiator (client) hasn't verified the identity of the target (server), which makes MiTM attacks possible 👀

Perfect Forward Secrecy (PFS): As defined in [RFC4949] 🔐

Man-in-the-Middle (MiTM) attack: As defined in [RFC4949] 🕵️‍♀️

OS protocol: A protocol that follows the opportunistic approach to security described in this doc 🎀

3. Opportunistic Security Design Principles ✨

Okay so OS is basically the bestie who shows up with a near-term plan to stop passive attacks by making encryption way more common 🔐💖. It gives you an incremental path toward authenticated, encrypted communication later, once the authentication tech is actually out there in the wild 🦋. Here are the design principles OS is obsessed with 💅:

Coexist with explicit policy: Explicit security policies preempt OS. Opportunistic security never displaces or preempts explicit policy 🙅‍♀️. Lots of apps and types of data are way too sensitive for OS, and more traditional security designs are the right call there 🔒.

Prioritize communication: The main goal of OS is to not impede communication while maxing out usable security 🌸. OS protocols need to be deployable incrementally, with each peer configured independently by its admin or user 🧚. With OS, communication still works even when some peers support encryption or authentication and others don't 🫶.

Maximize security peer by peer: OS protocols use encryption when it's mutually supported 🔥. OS protocols enforce peer authentication when an authenticated out-of-band channel is available to provide the requisite keys or credentials 👑. In general, communication SHOULD be at least encrypted 💜. OS SHOULD employ PFS wherever possible so that previously recorded encrypted communication stays safe from decryption even after a compromise of long-term keys 🛡️✨.

Wait, I need to be careful here. The original text uses lowercase "should" in that sentence, and the BCP 14 key words must stay exactly as the original has them. Let me correct that line below.

Maximize security peer by peer: OS protocols use encryption when it's mutually supported 🔥. OS protocols enforce peer authentication when an authenticated out-of-band channel is available to provide the requisite keys or credentials 👑. In general, communication should be at least encrypted 💜. OS should employ PFS wherever possible so that previously recorded encrypted communication stays safe from decryption even after a compromise of long-term keys 🛡️✨.

No misrepresentation of security: Unauthenticated, encrypted communication MUST NOT be misrepresented to users, or in application logs of non-interactive applications, as equivalent to authenticated, encrypted communication 🚫🙈.

An OS protocol first figures out the capabilities of the peer it's trying to talk to 🕵️‍♀️. Peer capabilities can be discovered by out-of-band or in-band means 🧩. (Out-of-band mechanisms include using DANE records, or cached keys or credentials acquired via TOFU. In-band determination implies negotiation between peers 🤝.) The capability determination phase might say the peer supports authenticated, encrypted communication; unauthenticated, encrypted communication; or only cleartext communication 🎀.

Encryption is used to mitigate the risk of passive monitoring attacks, while authentication is used to mitigate the risk of active MiTM attacks 🦹‍♀️. When encryption capability is advertised over an insecure channel, MiTM downgrade attacks to cleartext may be possible 😬. Since encryption without authentication only mitigates passive attacks, this risk is consistent with the expected level of protection 🤷‍♀️. For authentication to protect against MiTM attacks, the peer capability advertisements that convey support for authentication need to be over an out-of-band authenticated channel that is itself resistant to MiTM attack 🔐🧱.

Opportunistic security protocols MAY hard-fail with peers for which a security capability fails to function as advertised 💀. Security services that work reliably (when not under attack) are more likely to get deployed and turned on by default 🌈. It is vital that the capabilities advertised for an OS-compatible peer match the deployed reality 📣. Otherwise, OS systems will detect such a broken deployment as an active attack, and communication may fail 😭. This might mean that advertised peer capabilities are further filtered to consider only those capabilities that are sufficiently operationally reliable 🧹. Capabilities that can't be expected to work reliably SHOULD be treated by an OS protocol as "not present" or "undefined" 🙅‍♀️.

With unauthenticated, encrypted communication, OS protocols MAY employ more liberal settings than would be best practice when security is mandated by policy 🎈. Some legacy systems support encryption but only implement outdated algorithms or protocol versions, and compatibility with these systems avoids the need to resort to cleartext fallback 🧓.

For greater assurance of channel security, an OS protocol MAY enforce more stringent cryptographic parameters when the session is authenticated ✨. For example, the set of enabled Transport Layer Security (TLS) [RFC5246] cipher suites might exclude deprecated algorithms that would be tolerated with unauthenticated, encrypted communication 🔑.

OS protocols SHOULD produce authenticated, encrypted communication when authentication of the peer is "expected" 🫶. Here, "expected" means a determination via a downgrade-resistant method that authentication of that peer is expected to work 🛡️. Downgrade-resistant methods include: validated DANE DNS records, existing TOFU identity information, and manual configuration 📋. Such use of authentication is "opportunistic", in that it is performed when possible, on a per-session basis 🦋.

When communicating with a peer that supports encryption but not authentication, any authentication checks enabled by default MUST be disabled or configured to soft-fail, so we avoid unnecessary communications failure or needless downgrade to cleartext 🙌.

The support of cleartext and the use of outdated algorithms, and especially broken algorithms, is for backwards compatibility with systems already deployed. Protocol designs based on Opportunistic Security prefer to encrypt and prefer to use the best available encryption algorithms 🍓. OS protocols employ cleartext or broken encryption algorithms only with peers that do not appear to be capable of doing otherwise 🥲. The eventual goal is to transition away from cleartext and broken algorithms, and for broken algorithms in particular, it is highly desirable to remove such functionality from implementations 🗑️💅.

4. Example: Opportunistic TLS in SMTP 📬

Most Message Transfer Agents (MTAs) [RFC5598] support the STARTTLS [RFC3207] ESMTP extension 💌. MTAs acting as SMTP [RFC5321] clients generally support cleartext transmission of email 📨. They negotiate TLS encryption when the SMTP server announces STARTTLS support 🔐. Since the initial ESMTP negotiation isn't cryptographically protected, the STARTTLS advertisement is vulnerable to MiTM downgrade attacks 😱.

Recent reports from a number of large providers (e.g., [fb-starttls] and [goog-starttls]) suggest that the majority of SMTP email transmission on the Internet is now encrypted, and the trend is toward increasing adoption 📈🌸.

Various MTAs that advertise STARTTLS have interoperability problems in their implementations 🧩. As a work-around, it's common for a client MTA to fall back to cleartext when the TLS handshake fails, or when TLS fails during message transmission 🙃. This is a reasonable trade-off, since STARTTLS only protects against passive attacks 🤓. In the absence of an active attack, TLS failures are generally one of the known interoperability problems 🛠️.

Some client MTAs using STARTTLS abandon the TLS handshake when the server MTA fails authentication and immediately start a cleartext connection 😬. Other MTAs have been observed to accept unverified self-signed certificates, but not expired certificates, and again fall back to cleartext 🙈. These and similar behaviors are NOT consistent with OS principles, since they needlessly fall back to cleartext when encryption is clearly possible 🚫.

Protection against active attacks for SMTP is described in [SMTP-DANE] 🛡️. That document introduces the terms "Opportunistic TLS" and "Opportunistic DANE TLS", and is consistent with the OS design principles defined in this document 💖. With "Opportunistic DANE TLS", authenticated, encrypted communication is enforced with peers for which appropriate DANE records are present 👑. For the remaining peers, "Opportunistic TLS" is employed as before 🦋.

5. Operational Considerations 🛠️

OS protocol designs SHOULD minimize the possibility of failure of negotiated security mechanisms 🎯. OS protocols MAY need to employ "fallback" to work around a failure of a security mechanism that is found in practice to encounter interoperability problems 🔄. The choice to implement or enable fallback SHOULD only be made in response to significant operational obstacles 🧐.

When protection only against passive attacks is negotiated over a channel vulnerable to active downgrade attacks, and the use of encryption fails, a protocol MIGHT elect non-intrusive fallback to cleartext 🫠. Failure to encrypt may be more often a symptom of an interoperability problem than of an active attack 🔍. In such a situation, occasional fallback to cleartext may serve the greater good ✨. Even though some traffic is sent in the clear, the alternative is to ask the administrator or user to manually work around such interoperability problems 🧑‍💻. If the incidence of such problems is non-negligible, the user or administrator might find it more expedient to just disable Opportunistic Security 🙅‍♀️.

6. Security Considerations 🚨

OS supports communication that is authenticated and encrypted, unauthenticated and encrypted, or cleartext 🔐. And yet the security provided to communicating peers is not reduced by the use of OS, because the default OS policy employs the best security services available based on the capabilities of the peers, and because explicit security policies take precedence over the default OS policy 👑. OS is an improvement over the status quo; it provides better security than the alternative of providing no security services when authentication is not possible (and not strictly required) 💪.

While the use of OS is preempted by a non-OS explicit policy, such a non-OS policy can be counter-productive when it demands more than many peers can in fact deliver. A non-OS policy should be used with care, lest users find it too restrictive and act to disable security entirely 😭💀.

When protocols follow the OS approach, attackers engaged in large-scale passive monitoring can no longer just collect everything, and have to be more selective and/or mount more active attacks 🕵️‍♀️. In addition, OS means active attacks on everyone all the time are much more likely to be noticed 👀✨.

Specific techniques for detection and mitigation of active attacks in the absence of authentication are out of scope for this document 📚. Some existing protocols that could support OS may be vulnerable to relatively low-cost downgrade attacks for attackers on the path 😬. However, when such attacks are employed pervasively in order to facilitate, for example, surveillance, this is often detectable 🔎; hence, even in such scenarios, OS protocols provide a positive benefit 💖.

Protocols following the OS approach may need to define additional measures to make systematic downgrades less likely to succeed or more likely to be detected 🛡️. When we have more experience in this space, future revisions of this or related documents may be able to make more generally applicable recommendations 🔮.

7. References 📚

7.1. Normative References ✨

Okay so the normative references are the docs this RFC needs you to have read, bestie 📚 Here they are, no cap 💅

7.2. Informative References 🦋

These ones are the extra reading. Totally worth it, lowkey iconic 🧚

Acknowledgements 🫶

I would like to thank Dave Crocker, Peter Duchovni, Paul Hoffman, Benjamin Kaduk, Steve Kent, Scott Kitterman, Pete Resnick, Martin Thomson, Nico Williams, Paul Wouters, and Stephen Farrell for their many helpful suggestions and support. Literally everyone who made this possible, bestie 💖✨

Author's Address 🎀

Viktor Dukhovni Two Sigma

EMail: ietf-dane@dukhovni.org 💌

📦 where this page comes from