Subject: Re: [karp] Fwd: New Version Notification for draft-mahesh-bgp-ldp-msdp-analysis-00

From: "Bhatia, Manav (Manav)" <[email-masked]>
Date: Tue, 29 Mar 2011 18:15:30 +0530

Hi Mahesh,
 
I quickly looked at the document and couldn't find the gap analysis that this document promises to provide in the Introduction.
 
I was expecting some text saying that "while we have TCP-AO for BGP, there still are the following issues that exist with BGP .. blah blah" - I couldn't find any such text. In fact, I am not even sure I understand the gaps that you want the WG to look at.
 
Further when doing gap analysis in sec 4 you state the following in your document:
 
"The session layer that runs on TCP needs to protect itself by running TCP LISTEN only on interfaces on which its peers have been discovered or that are configured to expect sessions on."

I am a little confused with this - How would BGP know which interface to expect a TCP packet from for its IBGP peer that's peering using the loopback IP address?

Further you say that BGP, LDP, etc are vulnerable to spoofing and MITM attacks. Can you explain how this can happen when these use TCP-AO?

The draft also talks about privacy issues in some sections which I believe can completely be removed.

Cheers, Manav

________________________________

	From: [email-masked] [mailto:[email-masked]] On Behalf Of Mahesh Jethanandani
	Sent: Tuesday, March 01, 2011 9.11 AM
	To: [email-masked]
	Cc: Keyur Patel
	Subject: [karp] Fwd: New Version Notification for draft-mahesh-bgp-ldp-msdp-analysis-00

	The authors have submitted a draft that does a analysis of the current state of the three routing protocols per the karp analysis guide. Please review the draft and provide comments on it.
	
	Thanks.
	
	--mj
	
	-------- Original Message --------

	A new version of I-D, draft-mahesh-bgp-ldp-msdp-analysis-00.txt has been successfully submitted by Mahesh Jethanandani and posted to the IETF repository.
	
	Filename:        draft-mahesh-bgp-ldp-msdp-analysis
	Revision:        00
	Title:           Analysis of BGP, LDP and MSDP Security According to KARP Design Guide
	Creation_date:   2011-02-25
	WG ID:           Independent Submission
	Number_of_pages: 13
	
	Abstract:
	This document analyzes BGP, LDP and MSDP according to guidelines set
	forth in section 4.2 of [draft-ietf-karp-design-guide].

	The IETF Secretariat.

---

From: Mahesh Jethanandani <[email-masked]>
Date: Wed, 30 Mar 2011 04:28:54 -0700

Manav,

Thanks for reading the draft and providing your feedback.

On 3/29/11 5:45 AM, Bhatia, Manav (Manav) wrote:
>
> Hi Mahesh,
>
> I quickly looked at the document and couldn't find the gap analysis 
> that this document promises to provide in the Introduction.
>
> I was expecting some text saying that "while we have TCP-AO for BGP, 
> there still are the following issues that exist with BGP .. blah blah" 
> - I couldn't find any such text. In fact, I am not even sure I 
> understand the gaps that you want the WG to look at.
>
Our analysis found that from a protocol perspective LDP was the one that 
was vulnerable at the discovery time. For that there is a draft being 
presented at the meeting on Fri. And we will refer to it in our next 
version of the draft.
> "The session layer that runs on TCP needs to protect itself by running 
> TCP LISTEN only on interfaces on which its peers have been discovered 
> or that are configured to expect sessions on."
>
> I am a little confused with this - How would BGP know which interface 
> to expect a TCP packet from for its IBGP peer that's peering using the 
> loopback IP address?
>
That was written with eBGP in mind. Will update the draft.
>
>
> Further you say that BGP, LDP, etc are vulnerable to spoofing and MITM 
> attacks. Can you explain how this can happen when these use TCP-AO?
>
You are right in pointing out that the protocols will not be subject to 
these attacks if using TCP-AO. In that sense it is more a observation of 
the current implementations (that do not use TCP-AO) than on where the 
standards are. We can remove that.
>         The authors have submitted a draft that does a analysis of the 
> current state of the three routing protocols per the karp analysis 
> guide. Please review the draft and provide comments on it.
>
>         Thanks.
>
>         --mj
>
>         A new version of I-D, 
> draft-mahesh-bgp-ldp-msdp-analysis-00.txt has been successfully 
> submitted by Mahesh Jethanandani and posted to the IETF repository.
>

---

From: "Bhatia, Manav (Manav)" <[email-masked]>
Date: Wed, 30 Mar 2011 17:54:54 +0530

Vero,

If you look at Section 4, then this particular statement about BGP, LDP being vulnerable to spoofing and MITM was made in context of TCP, and thus my comment. 

Cheers, Manav

> -----Original Message-----
> From: zhenglianshu 50128 [mailto:[email-masked]] 
> Sent: Wednesday, March 30, 2011 5.50 PM
> To: Bhatia, Manav (Manav)
> Cc: Mahesh Jethanandani; Keyur Patel (keyupate); 
> [email-masked]; [email-masked]
> Subject: 回复:Re: [karp] Fwd: New Version Notification 
> fordraft-mahesh-bgp-ldp-msdp-analysis-00
> 
> Further you say that BGP, LDP, etc are vulnerable to spoofing 
> and MITM attacks. Can you explain how this can happen when 
> these use TCP-AO?
> 
> Vero-> Established LDP session could be tore down by spoofed 
> Hello, by specifying a smaller Hold Time or changing the 
> Transport Address.
> 
>  TCP-AO do not help since LDP Hello messages are sent using UDP.
> 
> draft-zheng-mpls-ldp-hello-crypto-auth-01decribes this 
> problem and introduces a new Cryptographic Authentication 
> TLV. I will present it on Friday, comments are welcome.
> 
> 
> 
> 
> 
> 
> 
> ----- 原邮件 -----
> 发件人: Mahesh Jethanandani <[email-masked]>
> 日期: 星期三, 三月 30日, 2011 下午1:27
> 主题: Re: [karp] Fwd: New Version Notification 
> fordraft-mahesh-bgp-ldp-msdp-analysis-00
> 收件人: "Bhatia, Manav (Manav)" <[email-masked]>
> 抄送: "Keyur Patel (keyupate)" <[email-masked]>, [email-masked]
> 
> > Manav,
> > 
> > > Further when doing gap analysis in sec 4 you state the following 
> > in 
> > > your document:
> > >
> > >         From: [email-masked] [mailto:karp-
> > [email-masked]] On 
> > > Behalf Of Mahesh Jethanandani