Subject: [Pce] Roman Danyliw's No Objection on draft-ietf-pce-applicability-actn-11: (with COMMENT)

From: Roman Danyliw via Datatracker <[email-masked]>
Date: Wed, 15 May 2019 12:40:52 -0700

Roman Danyliw has entered the following ballot position for
draft-ietf-pce-applicability-actn-11: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-pce-applicability-actn/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

I appreciate all of the references to the various security considerations in
Section 7.  My primary question in reading this section was “Does the use of
PCE in an ACTN introduce any additional vulnerabilities/threats/residual risk
and how is this addressed?” as this document was focused on the applicability
of PCE in ACTN.

(1) I wasn’t sure how [RFC5440] and [RFC6952] were applying specifically to the
ACTN use case.

(2) I wasn’t sure how to use the guidance in the third paragraph, “As per
[RFC8453] …”.  It notes that [RFC8453] outlines both needed security properties
and threats; and reiterates that [RFC8453] states that ACTN should have “rich
security features”.  The link and relevance to PCE was not evident.

---

From: Dhruv Dhody <[email-masked]>
Date: Thu, 16 May 2019 05:08:19 +0000

Hi Roman, 

Thanks for your comments. 

> I appreciate all of the references to the various security considerations
> in Section 7.  My primary question in reading this section was “Does the
> use of PCE in an ACTN introduce any additional
> vulnerabilities/threats/residual risk and how is this addressed?” as this
> document was focused on the applicability of PCE in ACTN.
> 
> (1) I wasn’t sure how [RFC5440] and [RFC6952] were applying specifically
> to the ACTN use case.
> 
[[Dhruv Dhody]] RFC5440 talks about various attack vectors, access policies to PCEP which applies to ACTN as well. RFC6952 can be removed. How about this - 

   Various security considerations for PCEP are described in [RFC5440]
   and [RFC8253].  Security considerations as stated in Section 10.1,
   Section 10.6, and Section 10.7 of [RFC5440] continue to apply on PCEP
   when used as ACTN interface.  Further, this document lists various
   extensions of PCEP that are applicable, each of them specify various
   security considerations which continue to apply here.   

> [RFC8453] …”.  It notes that [RFC8453] outlines both needed security
> properties and threats; and reiterates that [RFC8453] states that ACTN
> should have “rich security features”.  The link and relevance to PCE was
> not evident.
> 
[[Dhruv Dhody]] The next paragraph has - 

   When PCEP is used as an ACTN interface, the security of PCEP provided
   by Transport Layer Security (TLS) [RFC8253], as per the
   recommendations and best current practices in [RFC7525], is used.

I will merge this with the previous paragraph to link it and highlight the PCEP security feature. 

Working Copy: https://raw.githubusercontent.com/dhruvdhody-huawei/ietf/master/draft-ietf-pce-applicability-actn-12.txt
Diff: https://tools.ietf.org/rfcdiff?url1=draft-ietf-pce-applicability-actn-11&url2=https://raw.githubusercontent.com/dhruvdhody-huawei/ietf/master/draft-ietf-pce-applicability-actn-12.txt

Thanks! 
Dhruv
> 
> _______________________________________________
> Pce mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pce