Subject: Re: [RPSEC] Potential requirements

From: [email-masked]
Date: Tue, 12 Nov 2002 10:30:44 -0500 (EST)

>The new proposed requirement would be something like:
>
>===
>Proposed Requirement:
>  Networks [ed. note:  maybe "AS" instead of "Networks"?]

No, because these security requirements are supposed to cover all
routing protocols, not just BGP.  In the wireless world, it might
not even be "networks", just "nodes".

>                                                          participating
>  in routing exchanges must produce a routing  protocol security policy
>  to determine what action, if any, will be taken when a security 
>  violation occurs. The policy may contain items such as source, 
>  violation, and resulting action to take.  Further, there must be 
>  an automated mechanism to enforce the routing protocol security 
>  policy and can take action according to the policy.

How would a routing protocol ensure that the routing protocol security
policy determined an action to be taken?  Are you suggesting that every
routing protocol spec include a spec for the language in which the
policy would be expressed, so the routing protocol could examine it?
How would a routing protocol ensure that an automated mechanism
existed to take action according to the policy?  Are you suggesting
that the routing protocol itself perform all actions related to a
security violation?

Again - this is an operational requirement for ISPs.  A good idea, a
great idea - but not a security requirement for the routing protocol.

--Sandy
_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Steve Suehring <[email-masked]>
Date: Tue, 12 Nov 2002 09:54:11 -0600

> not even be "networks", just "nodes".

Correct.  My mistake on the phrasing.

> Are you suggesting

Certainly not.  Maybe I'm misunderstanding the wording contained in the
WG's charter and previous posts that routing systems are within the scope.  
I'm reading that to be a little wider scope than I probably should.  I
apologize.

Steve