Subject: [Srcomp] Analysis Text: Security

From: "Darren Dukes (ddukes)" <[email-masked]>
Date: Tue, 23 Mar 2021 02:29:51 +0000

Following up on last week’s actions, I’ve attached the proposed text for Security

5.  Security Requirements

5.1.  Security Mechanisms

   The compression solution SHOULD be able to address security issues
   that it introduces, using existing security mechanisms.

            +---------------------+------+-----+------+-------+
            |                     | CSID | CRH | VSID | UIDSR |
            +---------------------+------+-----+------+-------+
            | Security Mechanisms | Yes  | Yes | Yes  |       |
            +---------------------+------+-----+------+-------+

   Conclusion: All proposals resolve known security issues they are
   susceptible to.

5.2.  SR Domain Protection

   A compression solution must not require nodes outside the SR domain
   to know SID values within the SR domain, and it must provide the
   ability to block nodes outside an SR domain from accessing SIDS.

           +----------------------+------+-----+------+-------+
           |                      | CSID | CRH | VSID | UIDSR |
           +----------------------+------+-----+------+-------+
           | SR Domain Protection | Yes  | Yes | Yes  |       |
           +----------------------+------+-----+------+-------+

   Conclusion: All proposals describe how SIDs within the SR domain are
   protected.

---

From: "Chengli (Cheng Li)" <[email-masked]>
Date: Tue, 23 Mar 2021 08:29:11 +0000

Reply to security requirements for answering the three emails together since this has been replied to the email many days ago.

Yes, I think the results are correct for these requirements.

Thank you for filling out the tables, Darren.
Cheng

From: Srcomp [mailto:[email-masked]] On Behalf Of Darren Dukes (ddukes)
Sent: Tuesday, March 23, 2021 10:30 AM
To: [email-masked]
Subject: [Srcomp] Analysis Text: Security

Following up on last week's actions, I've attached the proposed text for Security

5.  Security Requirements

5.1.  Security Mechanisms

---

From: Ron Bonica <[email-masked]>
Date: Tue, 23 Mar 2021 13:55:04 +0000

Darren,

I think that UIDSR also gets a "YES" in both categories.

While our conclusions may be correct, they are not entirely satisfying. We should say *why* we think that all four solutions satisfy the requirement. For both requirements, we can say:

  *   SRv6 operates within a limited domain
  *   On the forwarding plane (Section 5.1), so long as a domain border router can identify an SRv6 packet, it can filter it
  *   On the control plane (Section 5.2), so long as a domain border router can identify SRv6 information, it can restrict its distribution outside of the domain
  *   All four compression mechanisms are identifiable on both domains.

                                                                                                     Ron

Juniper Business Use Only
From: Srcomp <[email-masked]> On Behalf Of Darren Dukes (ddukes)
Sent: Monday, March 22, 2021 10:30 PM
To: [email-masked]
Subject: [Srcomp] Analysis Text: Security

[External Email. Be cautious of content]

5.  Security Requirements

5.1.  Security Mechanisms