Subject: Re: [GROW] consensus on BMP security IPSEc vs TLS

From: "John G. Scudder" <[email-masked]>
Date: Tue, 12 Jan 2016 14:18:02 -0500

It's been several weeks, albeit with the holidays in the middle. In reviewing the responses I see assent to the IPSec option, albeit not enthusiastic. I don't think we have fully-worked TLS text on the table. I'd be happy to reissue with the IPSec text as proposed, if it's time.

Thanks,

--John

> On Dec 16, 2015, at 5:51 PM, Peter Schoenmaker <[email-masked]> wrote:
> 
> Hello,
> 
> We have reached the final stretch for draft-ietf-grow-bmp, but have hit a hiccup with regards to the proposal on the mechanism specified to secure the data.  We need to reach consensus on the text in the draft.  There has been extensive discussion on the mailing list.  
> 
> The authors have proposed the following text using IPSec:
> 
> Replace: This document does not specify any security mechanism for BMP.
> 
> With:  Where the security considerations outlined above are a concern, users
>   of this protocol should use IPsec [RFC4303] in tunnel mode with
>   preshared keys.
> 
> Can participants affirm the text is sufficient to cover securing BMP data?  If you feel it is not sufficient, propose alternate text for the document.
> 
> Thanks
> 
> Peter
> 
>

---

From: Jeffrey Haas <[email-masked]>
Date: Tue, 12 Jan 2016 14:46:04 -0500

> On Jan 12, 2016, at 2:18 PM, John G. Scudder <[email-masked]> wrote:
> 

It should be noted that TLS would require provisioning via configuration anyway.  While the popular solution for TLS involves a "STARTTLS" operation, BMP is currently a write-only to the client.  Reads are ignored by the server.

-- Jeff