ToppyMicroServices

RFC 7258 Quiz

Pervasive Monitoring Is an Attack

🇺🇸 🇯🇵
0 / 0

References (URLs)

Scope: RFC 7258 treats indiscriminate, very large-scale collection of protocol artifacts as a technical privacy attack. It supplies a review stance, not one mandatory mechanism, a legal classification, or a ban on all operational monitoring.

Q1: Which threat classification should the protocol review use?

Multiple Choice

A commercial operator collects headers, timing, packet sizes, and relationship graphs for nearly all users over long periods. It states that the collection is legal and intended for service improvement.

**Explanation:** A: RFC 7258 Section 1 includes state, commercial, and criminal actors and says motivation is not relevant to protocol mitigation. B: PM includes protocol metadata and traffic analysis, not only application content. C: Indiscriminate, very large-scale gathering of protocol artifacts matches the technical threat. Legal status does not change that design classification. D: Scale and indiscriminate collection distinguish PM; Section 2 separately recognizes beneficial monitoring.

Q2: Can a universal observation hook be exposed only to approved monitors?

Multiple Choice

A proposal adds a cleartext correlation identifier. Designers say benevolent operators will use it for abuse prevention, while malicious monitors should not gain the same capability.

**Explanation:** A: The protocol cannot distinguish the same collection technique by the observer's motivation. B: Section 1 says the same techniques can be used regardless of motivation. Section 2 requires careful consideration of the tension between beneficial monitoring and PM abuse. C: Documentation does not technically constrain later collection or correlation. D: Section 2 says making networks unmanageable is not acceptable; the design must justify an appropriate balance.

Q3: Is payload encryption a complete PM mitigation here?

Multiple Choice

An A2A transport encrypts task bodies but exposes stable agent identifiers, destination endpoints, message sizes, and timing. The same long-term keys span many sessions.

**Explanation:** A: Stable identifiers, endpoints, timing, and sizes can still link communications. B: Section 1 includes subversion of cryptographic keys among PM techniques; endpoint security and key management remain separate. C: Section 2 identifies metadata confidentiality, traffic analysis, and data minimization as concerns not solved merely by content protection. D: Mitigation need not completely prevent PM. Content confidentiality still raises attack cost despite residual exposure.

Q4: Which redesign best addresses the review finding?

Multiple Choice

A broker routes messages with a cleartext agent identifier stable across organizations and years. Routing needs a value within one exchange, but not global or long-term stability.

**Explanation:** A: Intended use does not reduce a stable identifier's value to a large-scale observer. B: Scoping and rotation reduce cross-context linkability while preserving routing. RFC 7258 Section 2 calls out data minimization and early architectural review. C: Removing the real name does not remove correlation when the replacement remains globally stable. D: The RFC does not require breaking protocol operation; unavoidable disclosures should be identified and minimized.

Q5: Does this count as mitigation under RFC 7258?

Multiple Choice

A change cannot stop a well-funded observer from correlating all traffic. It does encrypt content by default, removes a stable identifier, and makes remaining collection substantially more expensive and detectable.

**Explanation:** A: RFC 7258 Section 2 explicitly says mitigation does not imply complete prevention. B: The RFC prescribes no single mechanism; architectural or operational changes can alter the threat. C: A statement alone does not raise cost, make covert collection overt, or improve detection. D: Section 2 names those effects as meaningful mitigation even when the attack remains possible.

Q6: What must the authors provide before publication?

Multiple Choice

A new protocol exposes relationship metadata but has no section titled “Pervasive Monitoring Considerations.” The authors say the absence of a required heading proves that no further review is needed.

**Explanation:** A: Section 2 says a dedicated section is unnecessary, not that analysis is unnecessary. B: Non-technical legal and political questions are outside the IETF scope described by RFC 7258. C: Developers need to explain whether PM is relevant and, when it is, justify related architectural decisions. Early review matters because late changes are costly. D: The IETF does not control every implementation, but the specification remains responsible for its architectural exposure.

Q7: Which logging design best handles the monitoring tension?

Multiple Choice

An A2A platform proposes storing full grants, session proofs, task IDs, tenant IDs, and key fingerprints for 30 days in one searchable log. Responders need to investigate authorization failures, but not replay credentials or correlate every tenant.

**Explanation:** A: A legitimate purpose does not remove compromise, insider misuse, secondary use, or correlation risk. B: Section 2 recognizes beneficial monitoring and says making networks unmanageable is unacceptable. C: Derived failure events can preserve operational value while data minimization, redaction, scoped access, separation, and bounded retention reduce the observation surface. This applies Sections 1-2 without treating RFC 7258 as a detailed logging standard. D: At-rest encryption helps against some storage threats but does not minimize collection, privileged access, linkability, or credential replay after authorized decryption.