Subject: [pim] Stephen Farrell's Discuss on draft-ietf-pim-rfc4601bis-05: (with DISCUSS)

From: "Stephen Farrell" <[email-masked]>
Date: Tue, 26 May 2015 06:08:33 -0700

Stephen Farrell has entered the following ballot position for
draft-ietf-pim-rfc4601bis-05: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-pim-rfc4601bis/

----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

4601 used IPsec AH for it's MTI security. This removes that and
points at 5796 which defines how to use ESP for link local
addresses and with manual keying. That raises one technical
question and two ickky process questions. The ickky process
questions are probably best discussed between the IESG at least
initially in case we don't need to bother the authors/wg with
'em.

(1) I'd like to check that 5796 defines a way in which one can
secure all PIM messages that are defined here in 4601bis (should
one want to do that). If there are cases where PIM-SM can be
used and where there is no well defined security then I think
that would be a problem. And I think maybe there are such cases.
Am I wrong? If not, then how does one secure those?

(2) Is it ok for an IS to depend on a PS for it's MTI security
mechanism? (I think it is, but yeah, someone else might not.) 

(3) Is it ok for an IS to not conform to BCP107? (I think it
depends, and I'm not sure in this case.)

- My review was based on the diff vs 4601 [1] and the abstract
of 5796 which seems fairly clear though.

   [1]
https://tools.ietf.org/rfcdiff?url1=rfc4601&url2=draft-ietf-pim-rfc4601bis-05.txt

---

From: Brian Haberman <[email-masked]>
Date: Tue, 26 May 2015 10:29:19 -0400

Hi Stephen,

> https://datatracker.ietf.org/doc/draft-ietf-pim-rfc4601bis/

5796 focuses on the link-local messages (i.e., directly-connected
peers), but does say

   Securing the unicast messages can be achieved by the use of a normal
   unicast IPsec Security Association (SA) between the two communicants.

The above refers to the set of PIM messages that are not sent as
link-local.  My opinion is that this is sufficient given the uses of PIM
as defined in 4601.

> mechanism? (I think it is, but yeah, someone else might not.) 

I don't see why not.

> depends, and I'm not sure in this case.)

I am not sure how BCP 107 relates since it discusses Guidelines for
Cryptographic Key Management and the crypto stuff is now referred to via
5796.

Regards,
Brian

---

From: Barry Leiba <[email-masked]>
Date: Tue, 26 May 2015 10:58:03 -0400

> mechanism? (I think it is, but yeah, someone else might not.)

I look at this as saying that the protocol itself is Internet
Standard, but the MTI security part is, for now, Proposed Standard.
That seems like a perfectly sensible situation to me.

(And as to the downref, after the last and n-th round of silliness
about that, I now have Murray and Klensin discussing an update to BCP
97 to make it clear that good judgment in this regard is more
important than ticking process boxes.)

Barry

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 26 May 2015 15:59:36 +0100

> link-local.  My opinion is that this is sufficient given the uses of PIM

Hmm. So you're saying that the way to secure PIM-SM is to have a set
of unicast IPsec SAs that cover all of the routers in the MC group?
That seems a bit odd doesn't it?

>> mechanism? (I think it is, but yeah, someone else might not.) 

I agree I think, but would like to check if that's an IESG opinion
or just you and me. (Can be done on the call.)

> Cryptographic Key Management and the crypto stuff is now referred to via

Abstract of 5796 says it only supports manual keying. BCP107 says
you have to define automated keying (with some exceptions into which
PIM-SM doesn't fit). Those do seem to be in conflict I think.

S.

---

From: Brian Haberman <[email-masked]>
Date: Tue, 26 May 2015 11:10:28 -0400

Hi Stephen,

> That seems a bit odd doesn't it?

These are just PIM control messages (Register and Register-Stop) and
what you describe is exactly what you would have to do in the case of
4601.  All other PIM control messages are covered by 5796.  So, No, this
does not seem odd to me.

> or just you and me. (Can be done on the call.)

Sounds good.

> PIM-SM doesn't fit). Those do seem to be in conflict I think.

Right, but 5796 is not going to IS.

Regards,
Brian

---

From: "Alvaro Retana (aretana)" <[email-masked]>
Date: Wed, 27 May 2015 16:38:58 +0000

>or just you and me. (Can be done on the call.)

I won¹t be on the call tomorrow..

FWIW, I don¹t see why not either.

Thanks!

Alvaro.

---

From: Spencer Dawkins at IETF <[email-masked]>
Date: Thu, 28 May 2015 08:21:10 -0500

Hi, Stephen,

On Tue, May 26, 2015 at 9:59 AM, Stephen Farrell <[email-masked]>
wrote:

> >> Please refer to
> https://www.ietf.org/iesg/statement/discuss-criteria.html

We can talk about it on the call, but I'm agreeing with you and with Barry,
as is Alvero.

Spencer

---

From: William Atwood <[email-masked]>
Date: Thu, 28 May 2015 11:51:06 -0400

Hi, Spenser,

On 28/05/2015 9:21 AM, Spencer Dawkins at IETF wrote:
> Hi, Stephen,
>
> On Tue, May 26, 2015 at 9:59 AM, Stephen Farrell
> <[email-masked] <mailto:[email-masked]>> wrote:
>
>
>
No, it's a set of unicast IPsec SAs that cover all of the
_routers_closest_to_senders_ in the MC group.  For the cases where
multicast really makes a difference (i.e., few senders, many receivers)
this is likely to be a much smaller set.

  Bill
> We can talk about it on the call, but I'm agreeing with you and with
> Barry, as is Alvero.
>
> Spencer
>  
>
>     >
>     >>
> _______________________________________________
> pim mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pim

-- 
Dr. J.W. Atwood, Eng.             tel:   +1 (514) 848-2424 x3046
Distinguished Professor Emeritus  fax:   +1 (514) 848-2830
Department of Computer Science
   and Software Engineering
Concordia University EV 3.185     email:[email-masked]
1455 de Maisonneuve Blvd. West    http://users.encs.concordia.ca/~bill
Montreal, Quebec Canada H3G 1M8