- db-wg - mailman.ripe.net

Security of MD5 hashes in the RIPE Database
by Denis Walker 10 Jan '12

10 Jan '12

Dear Colleagues, The RIPE NCC Database Group is pleased to announce that the implementation of the MD5 password security change is now ready for deployment. This was discussed recently on the DB WG mailing list. The Database Group was asked to implement the technical change as outlined in this RIPE Labs article: https://labs.ripe.net/Members/denis/securing-md5-hashes-in-the-ripe-database The Database Group will now: - Fully deploy these changes on Thursday 12 January 2012 - Send emails to contact addresses in all MNTNER objects containing MD5 passwords recommending a password change and suggesting that a strong password be used - Perform a small MNTNER clean-up by preparing a list of unreferenced MNTNER objects and deleting those that are still unreferenced one month later. If you have not followed this discussion, we recommend that you read the RIPE Labs article to ensure that you understand the new process for maintaining MNTNER objects in the RIPE Database. A new version of Webupdates has already been deployed that asks for a password before allowing a MNTNER object with a password to be updated. But querying MNTNER objects from the RIPE Database will not change until Thursday. The full new software has been deployed on the TEST Database. So it is no longer possible to query a full MNTNER object that contains a password authentication token from the TEST Database, except by entering the password in Webupdates. Regards, Denis Walker Business Analyst RIPE NCC Database Group

1 0

DB email robot response and Precedence header
by Daniel Roesen 04 Jan '12

04 Jan '12

Hi, robot responses (like SUCCESS) do get sent with header From ripe-dbm(a)ripe.net, and no "Precedence: bulk" headers. So any response to those (e.g. out-of-office) will open a ticket with the ripe-dbm@ folks needlessly. For example, see NCC#2011125073. Would it make sense, to - use From: unread(a)ripe.net (like with the notification mails) and/or - add the "Precedence: bulk" header to avoid autoresponders kicking in? Best regards, Daniel -- CLUE-RIPE -- Jabber: dr(a)cluenet.de -- dr@IRCnet -- PGP: 0xA85C8AA0

2 1

Re: [db-wg] MD5 and Password Security in the RIPE DB, Fwd: Wonder if you can help - re: PDP
by David Kessens 14 Dec '11

14 Dec '11

Emilio, Wilfried, Nigel, Emilio wrote: > My apologies for sending the previous email to the full working group. > It was intended for the Database Working Group Chairs. But now that you accidentaly mailed us, I would like to take the opportunity to mention that I believe that we don't need the PDP process invoked for these kind of changes. I hope that we as a community have not petrified that far that we cannot request the RIPE NCC to make a change to the RIPE database and be done with it. To say it in a different way, the issue at hand is much closer (but not quite the same) to a bug fix/operational issue than a public policy change. David Kessens PS And regarding the topic of shadow passwords in the RIPE database, you might be interested in the following presentation by me from 1995, page 11: ftp://ftp.ripe.net/ripe/presentations/ripe-m22-david-DB-REPORT.ps.gz --- On Mon, Dec 12, 2011 at 10:55:23AM +0100, Emilio Madaio wrote: > Hi Nigel and Wilfried, > > as promised last week to Nigel, I'd like to make a short recap and > have your attention on the following. > > I have been contacted by David Freedman in regards of a couple of > policy proposals he sent you for review and possible submission to the > PDP. Below you can find, for more details, my summaries of the proposals > and what analysis we did in the NCC. > > As you will see, both cases can be tackled by the NCC with ideas that > can be discussed by the DB WG and, if approved, easily implemented. > Among the possible decisions you can take, there are also: > > -starting discussion in the mailing list now; or > -present and discuss at RIPE 64. > > Obviously we can consider, as David asked, to start the PDP if you deem > it necessary. > > In any case, David did not have a chance to hear from you, so I kindly > ask you to let him know, either your decision or that you acknowledged > his intentions. > > And please do not hesitate to let me know how I can help. > > > I included the email he sent so far and the aforementioned proposal texts. > > > Best Regards > Emilio Madaio > Policy Development Officer > RIPE NCC > > > -----oooooooo-------- > SUMMARIES: > > 1) The first proposal's scope regards the display of the MD5 password > hashes in the "auth:" attribute. Since then the DB department published > an article recommending the technical solutions of, in short: > > -filtering out "auth:" attributes from all query results on MNTNER objects > -adjusting Webupdates to require maintainer password authorisation over > HTTPS before presenting the object to the user for updating. > > This solution can be easy and quick to implement. They only need some > discussion in the DB WG. > > 2) The second proposal's scope regards the restriction to secure > channels for all the possible mntner authentications. In this instance > as well, the NCC can provide some quick technical alternatives for the > DB WG to discuss. > > > > > > > > > > > -------- Original Message -------- > [..] > > > Date: Tue, 15 Nov 2011 09:44:31 +0000 > From: David Freedman <david.freedman(a)eu.clara.net> > To: db-wg-chairs(a)ripe.net > Subject: My proposals > > Hi there, > > On 08/11 I sent you two policy proposals for review, concerning the > publication and use of MD5 authentication > attributes in the database. > > Since then, Denis Walker has published an article on RIPE labs describing a > potential solution to one of these issues > > https://labs.ripe.net/Members/denis/securing-md5-hashes-in-the-ripe-database > > Could you please tell me what happens next in the scope of both my proposals > and security community support for Denis' idea? > > Regards, > > David Freedman > > > Date: Tue, 8 Nov 2011 16:10:35 +0000 > From: David Freedman <david.freedman(a)eu.clara.net> > To: db-wg-chairs(a)ripe.net > Subject: Re: Policy Proposal "Removal of auth: MD5-PW from WHOIS > information" > > s/scheme/schemes, apologies > > On 08/11/2011 16:03, "David Freedman" <david.freedman(a)eu.clara.net> wrote: > > >Please see below: > > > >--------------------------- > > > >Number: > >(assigned by the RIPE NCC) > > > >Policy Proposal Name: Removal of auth: MD5-PW from WHOIS information > > > >Author: > > a. David Freedman > > > >b. david.freedman(a)uk.clara.net > > > >c. Claranet > > > >Proposal Version: > >(assigned by the RIPE NCC) > > > >Submission Date: 8/11/2011 > > > >Suggested RIPE WG for discussion and publication: Database Working Group > > > >Proposal Type: > >a. new > > > >Policy Term: > >b. Indefinite > > > >Summary of proposal: > >Policy text: > >b. New policy text > > > >This is a proposal to remove the display the "auth:" attribute for auth > >type "MD5-PW" in WHOIS information, in order to increase the security of a > >number of user's mntner objects. > > > >Rationale: > >a. Arguments supporting the proposal > > > >Numerous sources have demonstrated the vulnerability of the MD5-PW to > >compromise when presented with modern compute power, a number of alternate > >"auth" scheme exist which provide far more > >security to the mntner. By allowing these attributes to be exposed in > >WHOIS information, malicious entities could direct their efforts to > >computing a plaintext input of the hash and thus > >compromise mntner objects (and hence protected resources) of their choice. > > > >b. Arguments opposing the proposal > > > >The database group state: "Since any change in the current process means > >significantly changing the behaviour of the RIPE Database* and will break > >existing use cases of the system, it is not something the RIPE NCC can > >make a decision on.", this could involve significant work for the Database > >Group. > > > >*- As an example, current Update process requires the full object > >-including the hashes for maintainer objects- to be used in the update > >message. > > > >--------------------------- > > > > > Date: Tue, 8 Nov 2011 16:10:14 +0000 > From: David Freedman <david.freedman(a)eu.clara.net> > To: db-wg-chairs(a)ripe.net > Subject: New proposal : Prevention of use of MD5-PW over insecure channels > > See below > > ----------- > > Number: > (assigned by the RIPE NCC) > > Policy Proposal Name: Prevention of use of MD5-PW over insecure channels > > Author: > a. David Freedman > > b. david.freedman(a)uk.clara.net > > c. Claranet > > Proposal Version: > (assigned by the RIPE NCC) > > Submission Date: 8/11/2011 > > Suggested RIPE WG for discussion and publication: Database Working Group > > Proposal Type: > a. new > > Policy Term: > b. Indefinite > > Summary of proposal: > Policy text: > b. New policy text > > This is a proposal to ensure that all mntner authentication which makes > use of MD5-PW for an object transaction, do so over a secure channel, in > order to increase the security of such transactions. > > Rationale: > a. Arguments supporting the proposal > > Numerous sources have demonstrated the vulnerability of the MD5-PW to > compromise when presented with modern compute power, a number of alternate > "auth" schemes exist which provide far more > security to the mntner. By allowing the plaintext password to be passed > over insecure channels, information could be intercepted and the plaintext > password obtained, potentially compromising > mntner objects (and hence protected resources). > > b. Arguments opposing the proposal > > A number of object maintainers may currently make use of such insecure > channels (for example, unencrypted SMTP), these functions may be related > to legacy systems which are costly to update. > > > ----------- > > > Date: Tue, 8 Nov 2011 16:03:30 +0000 > From: David Freedman <david.freedman(a)eu.clara.net> > To: db-wg-chairs(a)ripe.net > Subject: Policy Proposal "Removal of auth: MD5-PW from WHOIS information" > > Please see below: > > --------------------------- > > Number: > (assigned by the RIPE NCC) > > Policy Proposal Name: Removal of auth: MD5-PW from WHOIS information > > Author: > a. David Freedman > > b. david.freedman(a)uk.clara.net > > c. Claranet > > Proposal Version: > (assigned by the RIPE NCC) > > Submission Date: 8/11/2011 > > Suggested RIPE WG for discussion and publication: Database Working Group > > Proposal Type: > a. new > > Policy Term: > b. Indefinite > > Summary of proposal: > Policy text: > b. New policy text > > This is a proposal to remove the display the "auth:" attribute for auth > type "MD5-PW" in WHOIS information, in order to increase the security of a > number of user's mntner objects. > > Rationale: > a. Arguments supporting the proposal > > Numerous sources have demonstrated the vulnerability of the MD5-PW to > compromise when presented with modern compute power, a number of alternate > "auth" scheme exist which provide far more > security to the mntner. By allowing these attributes to be exposed in > WHOIS information, malicious entities could direct their efforts to > computing a plaintext input of the hash and thus > compromise mntner objects (and hence protected resources) of their choice. > > b. Arguments opposing the proposal > > The database group state: "Since any change in the current process means > significantly changing the behaviour of the RIPE Database* and will break > existing use cases of the system, it is not something the RIPE NCC can > make a decision on.", this could involve significant work for the Database > Group. > > *- As an example, current Update process requires the full object > -including the hashes for maintainer objects- to be used in the update > message. > > --------------------------- > > David Kessens ---

6 7

Re: [db-wg] MD5 and Password Security in the RIPE DB, Fwd: Wonder if you can help - re: PDP
by Emilio Madaio 12 Dec '11

12 Dec '11

Dear Colleagues, My apologies for sending the previous email to the full working group. It was intended for the Database Working Group Chairs. Best Regards Emilio Madaio Policy Development Officer On 12/12/11 10:55 AM, Emilio Madaio wrote: >

1 0

2011-06 New Policy Proposal (Abuse Contact Management in the RIPE NCC Database)
by Denis Walker 30 Nov '11

30 Nov '11

Dear Colleagues The RIPE NCC Database Group has now published an article on RIPE Labs with a detailed explanation of how we propose to implement abuse handling with an "abuse-c:" attribute referencing a ROLE object. https://labs.ripe.net/ripe-database/abuse-handling-in-the-ripe-database This issue is currently being discussed on the Anti Abuse Working Group mailing list. Please direct any comments to that list. Regards Denis Walker Business Analyst RIPE NCC Database Group

1 0

Geolocation data prototype in the RIPE Database
by Denis Walker 07 Oct '11

07 Oct '11

Dear colleagues, At the RIPE 62 Meeting in Amsterdam the RIPE NCC Database Group was asked to investigate handling geolocation data in the RIPE Database. We now have a proof of concept prototype for discussion by the community. Based on input from a number of community sources and the subsequent presentation at RIPE 62, this prototype has two new optional attributes for storing geolocation data and language details. We have written an article about the design approach on RIPE Labs https://labs.ripe.net/Members/denis/geolocation-prototype-for-ripe-database This prototype references a sand-boxed TEST Database and does not have any pre-loaded geolocation or language data. But you can create your own data to see how easy it is to manage this new, optional information. We also have a prototype Geolocation Finder tool to search for this data. Another article on RIPE Labs shows how to create the new optional attributes and use the Geolocation Finder tool to search for this data. No changes in this sand-boxed TEST Database will affect the production RIPE or TEST Database services. The article is available at: https://labs.ripe.net/Members/denis/example-usage-of-ripe-database-geolocat… We invite comments or feedback on this design and suggestions for how to move forward if it is seen as a useful addition to the RIPE Database by the community. Regards Denis Walker Business Analyst RIPE NCC Database Group

7 10

2nd CfP: ICIW 2012 || May 27 - June 1, 2012 - Stuttgart, Germany
by Cristina Pascual 07 Oct '11

07 Oct '11

INVITATION: ================= Please, consider to contribute to and/or forward to the appropriate groups the following opportunity to submit and publish original scientific results to ICIW 2012. The submission deadline is set to January 5, 2012. In addition, authors of selected papers will be invited to submit extended article versions to one of the IARIA Journals: http://www.iariajournals.org ================= ============== ICIW 2012 | Call for Papers =============== CALL FOR PAPERS, TUTORIALS, PANELS ICIW 2012, The Seventh International Conference on Internet and Web Applications and Services May 27 - June 1, 2012 - Stuttgart, Germany General page: http://www.iaria.org/conferences2012/ICIW12.html Call for Papers: http://www.iaria.org/conferences2012/CfPICIW12.html - regular papers - short papers (work in progress) - posters - ideas Submission page: http://www.iaria.org/conferences2012/SubmitICIW12.html Submission deadline: January 5, 2012 Sponsored by IARIA, www.iaria.org Extended versions of selected papers will be published in IARIA Journals: http://www.iariajournals.org Please note the Poster and Work in Progress options. The topics suggested by the conference can be discussed in term of concepts, state of the art, research, standards, implementations, running experiments, applications, and industrial case studies. Authors are invited to submit complete unpublished papers, which are not under review in any other conference or journal in the following, but not limited to, topic areas. All tracks are open to both research and industry contributions, in terms of Regular papers, Posters, Work in progress, Technical/marketing/business presentations, Demos, Tutorials, and Panels. Before submission, please check and comply with the Editorial rules: http://www.iaria.org/editorialrules.html ICIW 2012 Topics (topics and submission details: see CfP on the site) IWAS : Internet and Web-based Applications and Services Web technologies, frameworks, languages, mechanisms; Web applications design and development; Interaction with/from Web-based applications; Web-based applications� features; Management of Web-based applications; Evaluation of Web applications; Specialized Web applications; Aggregating multimedia documents; E-business, appliances, and services; IP Grid Management and Grid Services; IP-based convergent solutions and next generation networks; Standards, case studies and special groups on web-based applications; E-business system design, development, and management for SMEs WSSA : Web Services-based Systems and Applications Service Innovations; Service Architectures; Model-driven development of context-aware services; Context-aware service models, architectures and frameworks; Model-driven development of semantic Web services; Web services foundation, architectures, frameworks, languages; Web services architecture and business continuity; Special Web services mechanisms; Semantic Web, Ontology, and Web services; Web service applications ; Data Management aspects in Web Services; Autonomic e-Business integration and collaboration; Web service based Grid computing and P2P computing; Web services based applications for e-Commerce; Multimedia applications using Web Services; Automatic computing for Web services; Web services challenges on trust, security, performance, scalability; Enterprise Web services; Web services discovery, announcing, monitoring and management; Platforms, technologies, mechanisms and case studies; Grid architectures, middleware and toolkits ENSYS: Entertainment Systems Developing entertainment systems and applications; Platforms for entertainment systems; Speech technology & its usability for entertainment systems; Networking requirements for entertainment systems; Traffic generated by entertainment applications; QoS/SLA on entertainment systems; Reliability and high availability of entertainment systems; Identify aspects in entertainment systems; Real-time access to entertainment systems; Customized access entertainment systems; Navigation and entertainment systems; Integration and interoperability aspects in entertainment systems; Entertainment systems and applications; Networking and system support for entertainment systems; Wireless and mobile technologies for entertainment; Wireless multimedia for entertainment; Systems for music and movie distribution; Games on mobile and resource-constrained devices; Mobile video entertainment systems; Car/flight/train entertainment systems; Ubiquitous entertainment systems; Interactive television; Technologies for sport and entertainment; WiFi wireless home entertainment systems; Wearable technologies for entertainment P2PSA: P2P Systems and Applications P2P architectures, techniques, paradigms; P2P programming and data handling; P2P security features; Data and compute intensive applications; P2P networks and protocols; P2P management; P2P Trust and reputation management; Fault tolerance in P2P, quality of availability, accounting in P2P; Self-adaptiveness in P2P overlay networks; Self-configurable P2P systems; Case studies, benchmarking; Copyright and intellectual property; Electronic marketplace, Digital asset management and trading systems; Platforms, environments, testbeds ONLINE: Online Communications, Collaborative Systems, and Social Networks Theory, frameworks, mechanisms, and tools for online communication; Methodologies and languages for on-line communications; Web services and XML use for online communications; Tools for assessing online work, distributed workload; Shared business processes; Collaborative groups and systems; Theory and formalisms of group interactions; Group synergy in cooperative networks; Online gambling, gaming, children groups; Identity features, risks, jurisdiction for online communications; Specifics emergency and e-coaching on online communications; B2B and B2E cooperation; Privacy, identify, security on online communications; Individual anonymity, group trust, and confidentiality on online groups; Conflict, delegation, group selection; Community costs in collaborative groups; Building online social networks with popularity contexts, persuasion, etc.; Technology support for collaborative systems; Techniques, mechanisms, and platforms for remote cooperation SERCOMP: Service computing Adaptive Architecture; Business process integration and management; Cloud Computing; Collective Intelligence for Service Computing; Computational Intelligence; Data Mining of Actual Services; Decision Science; Digital EcoSystems Infrastructure; Economic Clusters; Economics and Economic Experiments; Game Theory; Human Modeling in Services; Intelligent Agents and Multi-Agent Systems; Intra- and Inter-enterprise services; Knowledge Discovery for Service Computing; Nature Inspired Computing Techniques for Service Computing; Optimization of Service Processes; Psychological Approaches to Services; Self Organizing Infrastructure; Sensing of Human Behaviors; Service-centric business models and their economics; Service discovery, repository and registry; Service Engineering; Service evaluation, measurements and delivery audit; Service interaction, service ontologies and service composition; Service Marketing; Service-Oriented Architecture; Service Oriented computing; Soft Computing; Society and business services (public, utility, business, healthcare, consulting, etc.); Sustainable Frameworks; Swarm Intelligence; Ubiquitous and pervasive services (technology, context, security); Value Creation in Services; Web-based basics on service modeling, deployment and maintenance SLAECE: Social and Legal Aspect of Internet Computing Principles, theories, and challenges of legal and social aspects; Strategies, modeling, and requirements engineering of legal and social aspects; Architectures, implementations, and deployment consideration of legal and social aspects; Cyber threats, emerging risks, systemic concerns, and emergency preparedness; Social computing and lifestyle computing; Service marketing and customer relationship management; Market structures and emerging business models; Emerging legal issues due to new computing environment; File / information sharing networks and user behavior; Knowledge modeling, management, and application; Negotiation and contracting as well as contract monitoring and enforcement; E-democracy, e-policy, and governance; Legal and social ontologies; Privacy and copyright in collaborative environments and social networks; Intellectual property rights; Trust, security, and privacy; Counterfeit forensic; Identity management and access control; Security and privacy in location-based services VEWAeL: Virtual Environments and Web Applications for eLearning E-Learning; Web Technologies and Tools for Educational Purposes; Services for E-Learning Platforms; Virtual Learning Environments (VLE); Course Management Systems; Web applications for Teaching; Social Implications of E-Learning; Lifelong E-learning; Teaching-Learning Experiences using the Internet for Educational Purposes; E-learning in the European Higher Education Area (EHEA) and other HE contexts; Web protocols for VLE; Security for VLE; QoS for VLE; Storage management in VLE ECC: Enterprise cloud computing Architectures for enterprise clouds; Principles, concepts and methodologies of enterprise cloud computing; Tools, technologies, methodologies and frameworks for enterprise cloud computing; Enterprise IS architectures such as application, information and technology architectures; Synergies between SOA, Grid Computing and Cloud Infrastructures; Quality of Service (QoS) models; 'Elastic' and on-demand allocation and management of resources to meet business needs; Benefits, issues and limitations of enterprise clouds; Security, data integrity, legal and governance issues for enterprise clouds; Management, monitoring an governance issues; Portability of architectures, applications and data between cloud providers; Reliability and maintenance of cloud-based business architectures; Architectures for Software as a Service, Platform as a Service and Infrastructure as a Service; Network architecture using Storage Clouds; Experience reports with designing, building and using Cloud infrastructure; Novel application architectures, best practices, case studies and surveys ------------------------------ Technical Program Committee: http://www.iaria.org/conferences2012/ComICIW12.html ====================

1 0

Improvements to RIPE Database webforms
by Denis Walker 06 Oct '11

06 Oct '11

[Apologies for duplicate emails] Dear Colleagues, The RIPE NCC Database Group is pleased to announce some improvements to the database webforms. There is now an expanding menu on the right hand side of each form containing quick links to get to every form. You no longer need to bookmark each form and you can navigate to any other form quickly and easily. The query search results now have buttons for each object shown in the results. These buttons can be seen when you move your mouse over the object. By clicking one of these buttons, that object is opened in a Webupdates Form enabling you to either update or delete the object. Regards Denis Walker Business Analyst RIPE NCC Database Group

1 0

RFC 2317-style Reverse DNS Delegation in the RIPE Database
by Anand Buddhdev 21 Sep '11

21 Sep '11

[Apologies for duplicates] Dear colleagues, In April 2011, Denis Walker sent a proposal to the DNS and Database Working Groups outlining some reverse DNS-related changes to the RIPE Database. You can see the full proposal here: http://www.ripe.net/ripe/maillists/archives/db-wg/2011/msg00080.html I'm happy to report that this proposal has been fully implemented. This means that: - Dashes in the third octet of a DOMAIN object are no longer allowed - Dashes in the fourth octet are now allowed A dash in the fourth octet allows for RFC 2317-style reverse DNS delegation for Provider Independent (PI) address allocations which don't fall on octet boundaries. For this second change, we converted all existing delegations into appropriate DOMAIN objects in the RIPE Database. We will update the reverse DNS "how-to" on the RIPE NCC website over the next few days. If you have any questions, please send an email to <dns(a)ripe.net>. Regards, Anand Buddhdev DNS Services, RIPE NCC

1 0

RESTful API for create, delete and update
by Christopher Fuselier 20 Sep '11

20 Sep '11

Can someone please provide an update regarding RIPE's RESTful APIs for manipulating the RIPE database? The documentation <https://labs.ripe.net/ripe-database/database-api/api-documentation> points to <http://lab.db.ripe.net/whois> http://lab.db.ripe.net/whois as the URL for communicating with the RIPE and TEST databases. In my testing, transactions time out with that web service endpoint. Using a slightly different URL (http://apps.db.ripe.net/whois) queries succeed but updates do not. Could it be that the web service URL has changed? Or is the e-mail template approach still preferred? Thank you in advance... Cheers, Christopher Fuselier

2 1