Subject: [Rserpool] Two security issues from IETF #57

From: [email-masked]
Date: Wed, 23 Jul 2003 10:06:21 -0500

The security discussion at IETF #57 raised two issues that we agreed would be brought to the list for comment.

Issue #1
TLS or IPsec mandatory to implement?

The security design team consensus was that the network designer could either use TLS or IPsec as mandatory to implement for ENRP-PE and ENRP-ENRP communication.  The PU-ENRP was previously decided to be mandatory to implement TLS for reasons of interoperability.    Direction from the ADs and consensus in the meeting was that one security mechanism should be made mandatory to implement for all.  It was agreed to select TLS as mandatory to implement by those attending the meeting.  Do the people on the list agree?

Issue #2
Security of ENRP server registrations and ENRP to ENRP communications

Other clarifications included the restriction of pool elements within a particular pool to provide the same level of security, for simplicity.  In addition, an ENRP server will either have all registrations and thus namespace entries secured or none, also for reasons of simplicity.  A mixed security rating for the elements stored in the ENRP database would complicate the client as well as the ENRP server.   The client would have to implement a security policy which would review the entries returned by ENRP and select them based on a security policy.  It is also unclear what the impact of a mixed database is on security as a whole.  It was agreed to restrict the ENRP database to secure registrations only and secure communications between ENRP servers OR insecure registrations only by those attending the meeting.  Do the people on the list agree?

Comments?

-- maureen

_______________________________________________
rserpool mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rserpool

---

From: Silverton Aron-C1710C <[email-masked]>
Date: Wed, 23 Jul 2003 10:26:13 -0500

Hi Maureen,

Comments inline.

[email-masked] wrote:
> The security discussion at IETF #57 raised two issues that we agreed
> would be brought to the list for comment. 
> 
> Issue #1
> The security design team consensus was that the network designer
> could either use TLS or IPsec as mandatory to implement for ENRP-PE
> and ENRP-ENRP communication.  The PU-ENRP was previously decided to
> be mandatory to implement TLS for reasons of interoperability.   
> Direction from the ADs and consensus in the meeting was that one
> security mechanism should be made mandatory to implement for all.  It
> was agreed to select TLS as mandatory to implement by those attending
> the meeting.  Do the people on the list agree? 

Agree.  
    
> Security of ENRP server registrations and ENRP to ENRP communications

<snip>

 It was agreed to
> restrict the ENRP database to secure registrations only and secure
> communications between ENRP servers OR insecure registrations only by
> those attending the meeting.  Do the people on the list agree?  

I'm not sure that I understand what was agreed upon.  Are we talking about
two modes of operation:

(1) Secure registrations only and secure ENRP-ENRP traffic, and
(2) Insecure registrations only and insecure ENRP-ENRP traffic?

My feeling is that ENRP-ENRP should be secured in any case, but this may not
be practical.  This will have an affect on the use of multicast between ENRP
servers and I believe that we should discuss this during the next security
design team meeting.  (I have previously sent an email regarding this to the
design team members.)  My thought would be to disallow use of multicast in
ENRPv1, but leave a section in the draft explaining how it could be used
properly with secure multicast.  Perhaps by ENRPv2, there will be a secure
IGMP or something similar.  Developing our own custom secure multicast
option should not be an option in my opinion. 

In all likelihood, an operator with a closed system (not traversing the
Internet) will probably choose to do whatever they want in terms of
ENRP-ENRP security and multicast.
   
> -- maureen

Regards,

Aron

---

From: Silverton Aron-C1710C <[email-masked]>
Date: Wed, 23 Jul 2003 10:26:13 -0500

Hi Maureen,

Comments inline.

Agree.  

<snip>

 It was agreed to

   

Regards,

Aron