Subject: [bess] Kathleen Moriarty's Discuss on draft-ietf-bess-mvpn-extranet-04: (with DISCUSS)

From: "Kathleen Moriarty" <[email-masked]>
Date: Thu, 17 Dec 2015 17:47:10 -0800

Kathleen Moriarty has entered the following ballot position for
draft-ietf-bess-mvpn-extranet-04: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-bess-mvpn-extranet/

----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

I just have one question/request to improve the security consideration
section.  The only security mentioned in this draft is what's called a
"security violation", where traffic may go to the incorrect "VPN"
endpoint.  If you are worried about traffic winding up in the wrong
place, why is there no consideration for observing this traffic on the
wire?  Since there is no encryption, wouldn't this also be a security
consideration to call out specifically? 

Mention of the possibility of active attacks that could alter or tamper
with the traffic or passive attacks that could observe the traffic as a
risk due to lack of encryption (confidentiality protection) would help or
a reason why this doesn't matter.

Thanks!

---

From: Eric C Rosen <[email-masked]>
Date: Fri, 18 Dec 2015 10:24:36 -0500

> a reason why this doesn't matter.
The reason I didn't mention this in the Security Considerations section 
is that the issues are not specific to Extranet MVPN, which is the topic 
of this document.   The Security Considerations section mentions those 
issues that could result in misdelivery of traffic if the procedures of 
the document are not properly executed; this set of issues is certainly 
within the scope of the document.

I understand that there are issues having to do with the possibility of 
observing or altering the traffic on the wire.  Certainly I could 
mention that the procedures of this document do not provide encryption, 
and hence do not by themselves ensure the privacy/integrity of the data 
against attacks on the backbone network.   Would that be sufficient?

I don't want to make any specific recommendations for mitigating those 
attacks, because:

- Issues of how to provide privacy/integrity for multicast traffic in 
general would seem to be out of scope for this document;

- Issues of how to provide privacy/integrity for various 
tunneling/encapsulation methods would seem to be out of scope for this 
document;

- Issues of how to provide privacy/integrity for the base L3VPN 
technology would seem to be out of scope for this document;

- Issues of how a Service Provider can protect its backbone network 
against various attacks would also seem to be out of scope for this 
document.

---

From: Kathleen Moriarty <[email-masked]>
Date: Fri, 18 Dec 2015 11:19:54 -0500

Hi Eric,

On Fri, Dec 18, 2015 at 10:24 AM, Eric C Rosen <[email-masked]> wrote:
> The reason I didn't mention this in the Security Considerations section is
> that the issues are not specific to Extranet MVPN, which is the topic of
> this document.   The Security Considerations section mentions those issues
> that could result in misdelivery of traffic if the procedures of the
> document are not properly executed; this set of issues is certainly within
> the scope of the document.
>
> observing or altering the traffic on the wire.  Certainly I could mention
> that the procedures of this document do not provide encryption, and hence do
> not by themselves ensure the privacy/integrity of the data against attacks
> on the backbone network.   Would that be sufficient?

Yes, just having that warning would go a long a way.  I'm not asking
you to solve it (although that would be nice), but rather to make sure
it is included as a security consideration.

Let me know when the text has been added and I'll clear.

Thanks!
Kathleen
> - Issues of how to provide privacy/integrity for the base L3VPN technology
> would seem to be out of scope for this document;
>
> - Issues of how a Service Provider can protect its backbone network against
> various attacks would also seem to be out of scope for this document.
>
>
>
>
>
>

-- 

Best regards,
Kathleen

---

From: "Alvaro Retana (aretana)" <[email-masked]>
Date: Mon, 21 Dec 2015 22:49:09 +0000

Kathleen:

Hi!

Eric updated the draft a couple of hours ago. ;-)

Please take a look.

Thanks!

Alvaro.