Subject: [Netconf] Unsigned configlets and physical security

From: Joe Marcus Clarke <[email-masked]>
Date: Mon, 03 Mar 2014 12:06:43 -0500

Kent mentioned the open issue with unsigned configlets on USB keys (or 
near-field).  He alluded to some comments that I had made on the 
ZeroTouch draft.  While I see the convenience and benefit of allowing 
unsigned configlets, I was worried that if I have a device in a secure 
environment (e.g., clean room in a DC), that an attacker doesn't need to 
get into this room to circumvent security (i.e., they don't need 
_physical_ security).

Instead, they just need to get a hold of my USB key and insert a 
malicious configlet.  Then I need to insert it into my otherwise 
physically secure device, and it will load the [unsigned] malicious 
bootstrap config.

Kent's argument was that one should check the contents of the configlet 
before loading (it is clear text after all).  So this may be a 
non-issue.  However, I wanted to raise it with the WG to see what others 
think.

Joe