bk99.de entertain the web since 1997

bk99.de
RFC · SecurityStandard explained

RFC 7258: Pervasive monitoring is an attack

Summary

RFC 7258 explicitly declares large-scale passive monitoring a form of attack that protocol design must take into account. Threat models have to include powerful global observers. Encryption by default changes privacy for the whole network.

Ideas

  • Passive observers collect content and metadata of many users.
  • Encryption should become the normal case wherever possible.
  • Protocols should avoid unnecessary observable data.

Remarks

  • RFC 7258 has the status “Best Current Practice”; current errata and successor documents should also be checked.

Recommendations

  • Enable encryption by default rather than as an option.
  • Minimise unencrypted metadata and long-lived identifiers.

References

Read the RFC at the RFC Editor

Search the Web Archive

RFC · 2010

RFC 5961: Hardening TCP against blind reset and SYN attacks

RFC 5961 improves TCP checks so that spoofed segments find it harder to reset or disrupt existing connections. Small state checks can greatly increase the cost of an attack. Old protocols stay robust through targeted, compatible fixes.

RFC · 2004

RFC 3711: SRTP: Confidential real-time media

RFC 3711 adds encryption, integrity and replay protection for audio and video streams to RTP. Real-time security must combine low delay with effective protection. Key management remains a central task outside the media format.