https://DevOpsCloud.io -- Cloud Monk Losang Jinpa, Ph.D., MCSE/MCT, GitOps DevOps Engineer

Return to Security-Related RFCs, Network Security, Container Security - Kubernetes Security, Cloud Security, Web Security, DevSecOps

See: 7435 on datatracker.ietf.org

RFC 7435 introduces the concept of “Opportunistic Security” (OS), a security model designed to provide flexible protection in environments where full security mechanisms, such as TLS with strict certificate validation, are either impractical or not required. The document outlines how opportunistic security can be deployed to improve communication security incrementally, without the all-or-nothing approach traditionally used in cryptographic systems. RFC 7435 focuses on enabling encryption when possible but without the requirement of absolute authentication, thus providing some level of protection even in situations where strict security requirements cannot be met.

The primary goal of RFC 7435 is to encourage the use of encryption in situations where it might otherwise be bypassed due to complexity, cost, or performance concerns. The model advocates for encrypting communications wherever feasible, without mandating that encryption be coupled with strong authentication or identity verification. As a result, even when full authentication isn't possible, OS ensures that data is encrypted, making it more difficult for attackers to intercept or manipulate the communication.

One of the key concepts explained in RFC 7435 is that OS does not necessarily prioritize authenticity and integrity as highly as traditional security models like TLS with strict certificate validation. Instead, the goal is to maximize security for the greatest number of connections, even if some compromises need to be made in terms of authentication. This approach lowers the barrier to implementing security, allowing more systems to adopt encryption without the overhead and complexity of full certificate-based authentication.

RFC 7435 outlines several scenarios where opportunistic security is beneficial. For example, in environments where a large number of devices must communicate over untrusted networks, it may not be feasible to deploy and manage the necessary infrastructure for full certificate validation. In such cases, OS allows for the use of encryption to protect against passive attackers, while accepting the possibility that active attackers could still impersonate or alter communications. The benefit is that opportunistic security significantly raises the bar for attackers, even if it doesn't provide the same level of assurance as fully authenticated connections.

The opportunistic security model also applies to protocols where strong identity verification may not be necessary or desirable. For instance, in machine-to-machine communications or Internet of Things (IoT) environments, enforcing strict identity verification may introduce performance bottlenecks or operational challenges. RFC 7435 suggests that by using opportunistic encryption, these systems can still benefit from increased confidentiality without the complexity of full-scale authentication mechanisms.

RFC 7435 emphasizes the principle of “best-effort security,” meaning that encryption should be applied whenever possible, even if some connections cannot be fully authenticated. This is a departure from the traditional all-or-nothing model of security, where failure to fully authenticate a connection might result in no security being applied at all. Instead, OS seeks to maximize security across a wide range of scenarios, even if that security falls short of traditional expectations in some cases.

Another important point made in RFC 7435 is that opportunistic security is not intended to replace stronger security measures but to complement them. When full authentication is feasible, it should be used. However, when it is not possible, opportunistic security provides a fallback that still offers protection. This makes OS an incremental step toward broader encryption adoption, as it allows systems to start with partial security and gradually improve over time as infrastructure and resources allow.

The document also addresses potential concerns about downgrades and man-in-the-middle attacks in the OS model. While RFC 7435 acknowledges that opportunistic security is more vulnerable to active attacks than fully authenticated models, it argues that the benefits of encrypting traffic, even in the absence of strong authentication, outweigh the risks in many contexts. The model encourages the use of encryption even in situations where strict authentication is unavailable or impractical, thus reducing the likelihood of passive eavesdropping.

RFC 7435 highlights the use of DANE (DNS-Based Authentication of Named Entities) and DNSSEC as supporting mechanisms for opportunistic security. By using DNSSEC-protected DNS records to authenticate cryptographic material like TLS certificates, systems can improve their security posture in an opportunistic model. This allows for more flexible authentication that does not rely on the traditional public key infrastructure, which can be burdensome to manage, particularly in large-scale environments.

Lastly, the opportunistic security model laid out in RFC 7435 is seen as a way to increase the overall security of the internet by making encryption more accessible. While fully authenticated connections remain the gold standard for security, OS enables a broader range of systems to adopt encryption without the overhead and complexity of managing strong authentication for every connection. In doing so, RFC 7435 aims to reduce the amount of plaintext traffic on the internet, helping to protect sensitive data from passive attackers.

In conclusion, RFC 7435 presents the opportunistic security model as a flexible and pragmatic approach to improving communication security in a wide range of environments. By focusing on encryption as a baseline and allowing for reduced authentication requirements in certain cases, OS seeks to increase the adoption of security mechanisms without the rigidity and overhead of traditional cryptographic models. The document emphasizes the benefits of “best-effort security,” encouraging encryption wherever possible, even if full authentication cannot be achieved. RFC 7435 is a valuable tool for organizations looking to improve their security posture in cases where strict authentication might be impractical. The full text of RFC 7435 can be found on the IETF website at https://datatracker.ietf.org/doc/html/rfc7435.