SoK: An Analysis of Protocol Design: Avoiding Traps for Implementation and Deployment

摘要: Today's Internet utilizes a multitude of different protocols. While some these protocols were first implemented and used later documented, other specified then implemented. Regardless how came to be, their definitions can contain traps that lead insecure implementations or deployments. A classical example is insufficiently strict authentication requirements in protocol specification. The resulting Misconfigurations, i.e., not enabling strong authentication, are common root causes for security incidents. Indeed, have been commonly designed without mind which leads misconfiguration traps. this slowly changing, considerations similarly bad effect. Due complex insufficient documentation, features may remain unused, leaving deployments vulnerable. In paper we provide systematization the found By separating four classes identify major factors These insights together with observations about end-user centric usability by default derive recommendations improving existing designing new protocols---without such sensitive operators, implementors users.