Subject: Minutes of the IDR working meeting at IETF 56

From: "Susan Hares" <[email-masked]>
Date: Mon, 14 Apr 2003 01:15:20 -0400

Wednesday, March 19 1530-1730
=============================

CHAIRS: Sue Hares ([email-masked])
	Yakov Rekhter ([email-masked])

The following was the agenda for the IDR meeting
on 3/19/2003. 

AGENDA:

 1530-1545 Administrivia (Yakov Rekhter, Sue Hares)

            Agenda Bashing
            Minutes
            Blue Sheets
            WG Document Status 

 15:45-16:10 Flexible BGP Communities (Andrew Lange)

    http://www.ietf.org/internet-drafts/draft-lange-flexible-bgp-communities-00.txt

 16:10-16:25 BGP Security Vulnerabilities Analysis (Sandy Murphy)

    http://www.ietf.org/internet-drafts/draft-murphy-bgp-vuln-02.txt

===========

   1) Administrivia:

	WG document status: 
	
	The Base BGP protocol specification is complete.  The editor's thanks
	go to Andrew Lange.  
		draft-ietf-idr-bgp4-19.txt has incorporated all the comments
		we have received. draft-ietf-idr-bgp4-20.txt includes a few
		more editorial changes.

		We have completed last call the document.  The resulting document
		will be forwarded to IESG.

	This document goes with a package of documents that detail the 
	BGP4: 
		1) draft-ietf-idr-bgp4-20.txt 
		2) draft-ietf-idr-bgp4-mib-10.txt (version 1 MIB)
		3) BGP security analysis 
			draft-murphy-bgp-vuln-02.txt which will be re-issued as
			draft-ietf-idr-bgp4-vuln-01.txt

	The draft-ietf-idr-bgp4-mib-10.txt will be issued lasted call
	on the mail list which ends on 3/24.

	The BGP security analysis document needs to be reviewed and comments
	sent ASAP. 

	And a group of reports for the IESG: 
		1)  BGP-4 Protocol Analysis (Dave Meyer, Keyur Patel)
		2) Experience with the BGP-4 Protocol 
		    (Danny McPherson, Keyur Patel) 

		3) BGP implementation report 
		    (Alvaro Retano) 

	Will be uploaded as idr documents.  Please comment on
	these documents.

B) 15:46 -16:10 Flexible BGP communities

	Andrew Lange gave a presentation on BGP communities in
		BGP Flexible Communities.ppt

	A discussion ensued afterward containing the following points:
	
	a) Should this specification supercede the base communities,
	   the Extended communities or should this document only include
	   communities not specified in these two drafts?

	    Several people (Enke Chen, Yakov Rekhter) felt that it imposed
	    a deployment burden if the draft superceded these two document.
	    Additional discussion of this point

	b) Should this work continue.  
	    Several people felt this work was useful. Additional feedback
	    was given to the author.  Additional discussion will continue
	    on the list. 

c) 16:10-16:25 BGP Security Vulnerabilities Analysis (Sandy Murphy)

    http://www.ietf.org/internet-drafts/draft-murphy-bgp-vuln-02.txt

    Sandy present the slides idr.vulnerabilities.ppt
    After the presentation, a discussion about the drat continued with 
    the following points:

	a) The use of unconfigured peers in the base draft.
	b) The use of TTL as an alternative security mechanisms for
	   unconfigured peers,

	c) Do we include failure scenarios where a BGP
 	   Speaker doesn't send info it was supposed to send.  
	     eg not sending a WITHDRAW

	d) We need to make sure the draft is clear that there
 	   are two types of attacks:
             1) Spoofs/session interrupts/disruptive attacks.
             2) Poison info attacks (sending malicious info)

    On Unconfigured peers (point a), the discussion centered around
    re-opening the issue of unconfigured peers.  The majority of the
    working group did not want to re-open the issue.  The general
    consensus was that an explanation for unconfigured peers be added
    to the experience draft.  

    On item b, the use of TTL as a security issue, Yakov pointed out
    that the TTL document is not even a working group document.  We
    are progressing BGP (in 3 documents base, mib, security document)
    on what is.  Sandy Murphy pointed out that TTL doesn't work
    with EBGP multi-hop.  Vijay agreed with Sandy, but indicated that
    TTL works for most cases.  Sandy pointed out that security analysis
    are required to look security in all cases.  The TTL document
    is new work and will not be discussed until the Routing ADs lift
    the hold on new work.

    On item c, the consensus was to leave this out because it
    contains no information.  There is no way to differentiate between a bug
    in an implementation and an attack for these "attacks of omission".

    On item d, Sandy Murphy indicated that it was included in the draft.
    Comments are welcomed to clarify the text.