Subject: RE: [RPSEC] Charter Bashing...

From: "Manral, Vishwas" <[email-masked]>
Date: Fri, 5 Apr 2002 09:30:31 -0500

Russ,

I had an query. The charter seems to say: -

   The products of this working group will be used by routing
   protcool designers to ensure adequate coverage of security in the
   future, including well known and possible threats. It is not the
   goal of this working group to revisit current routing protocol
   security mechanisms.

I wanted to know what we should consider security threats? In the sense, the
set of threats when we use security mechanisms such as MD5 etc are used are
different from when they are not. Because as for many existing protocols
now, the simple answer to a lot of security issues seems to be "use MD5". 

Also as most of the threats and solutions will be based on experience we
have from existing protocols, I guess we can always have suggestions for
existing protocols too and not preclude it from the charter. At the least
least we can remove the sentence "It is not the goal of this working group
to revisit current routing protocol security mechanisms." even if we do not
add anything more to the charter regarding this. Agree???

Thanks,
Vishwas

-----Original Message-----
From: Russ White [mailto:[email-masked]]
Sent: Friday, April 05, 2002 4:31 PM
To: Tony Tauber
Cc: [email-masked]
Subject: Re: [RPSEC] Charter Bashing...

> > The lack of a common set of security requirements and methods for
> > routing protocols has resulted in a wide variety of security
> > mechanisms for individual routing protocols.  Ongoing work on
> > requirements for the next generation routing system and future
> > work on the actual mechanisms for it will require well documented
> > routing security requirements.
> >
> > The products of this working group will be used by routing
> > protcool designers to ensure adequate coverage of security in the
> > future, including well known and possible threats. It is not the
> > goal of this working group to revisit current routing protocol
> > security mechanisms.
> >
> > The goal of this BOF is to discuss creation and charter of a WG
> > in the routing area that would be charged with the following
> > tasks:
> >
> >  - Document threat models for routing protocols
> >  - Document security requirements for routing protocols
> 
> What about generalizing to other network control signalling
> protocols like LDP and RSVP?

As long as they are within the routing area, then I don't see any
problem with extending to these....

> I know I mentioned this idea to you prior to the BOF and
> someone beat me to mentioning it on the mic, but that comment
> didn't make it into the published minutes.

First, you'll have to sit closer to the mic next time. Second,
I'll have to try and write faster, or learn to bring a second
notebook to type on (since I type faster than I write, at least
legibally).

:-)

Russ

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Russ White <[email-masked]>
Date: Sat, 6 Apr 2002 10:25:36 -0500 (EST)

> I wanted to know what we should consider security threats? In
> the sense, the set of threats when we use security mechanisms
> such as MD5 etc are used are different from when they are
> not. Because as for many existing protocols now, the simple
> answer to a lot of security issues seems to be "use MD5".

This is another interesting question that was brought up at the
bof.... Perhaps there should be some doc that lays out what the
concept and definition of a 'threat' is, including such things as
inentional and unintentional misconfigurations....

> Also as most of the threats and solutions will be based on
> experience we have from existing protocols, I guess we can
> always have suggestions for existing protocols too and not
> preclude it from the charter. At the least least we can
> remove the sentence "It is not the goal of this working group
> to revisit current routing protocol security mechanisms."
> even if we do not add anything more to the charter regarding
> this. Agree???

See the last verison of the charter I just sent out.

:-)

Russ

__________________________________
[email-masked] CCIE <>< Grace Alone