Subject: [Taps] Opsdir telechat review of draft-ietf-taps-transport-security-11

From: Susan Hares via Datatracker <[email-masked]>
Date: Thu, 16 Apr 2020 03:35:34 -0700

Reviewer: Susan Hares
Review result: Ready

Greetings:

This is an ops-dir review  that looks at the operational aspects of any draft. 

Overall: Thank you for a clear and well-written document. 

This draft is well written and clear.    One minor editorial nitty-nit.
One personal plea from the IDR  co-chair(WG that maintains BGP), 
and co-author of BGP (RFC4771).   

Personal plea: 
You've clear stated the BGP issue up front. 
 TCP MD5 is bad (due to privacy issues) and TCP-AO 
is not deployed..  Has the TAPs given any thought to 
what might be  a replacement that could utilize some of the modern 
TCP.   Would any of your co-authors be willing to chat about 
this issue? 

The  very minor editorial nitty-nit. 
Would you please check the order of the items in 
the pre-shared key import (PSKI) [p. 13-14] 
to see that it is the same order as the table.

---

From: Joseph Touch <[email-masked]>
Date: Thu, 16 Apr 2020 08:31:30 -0700

Hi, Susan,

> On Apr 16, 2020, at 3:35 AM, Susan Hares via Datatracker <[email-masked]> wrote:
> 
> Reviewer: Susan Hares
> ...
> Personal plea: 
> is not deployed..

It is available in Cisco IOS at least. Its biggest drawback appears to be a lack of open-source implementations.

>  Has the TAPs given any thought to 
> TCP.  

Given the problem with TCP-AO deployment is that there is no free implementation and low implementation by vendors, how exactly would a new solution with even less implemented code help?

Joe

---

From: "Scharf, Michael" <[email-masked]>
Date: Thu, 16 Apr 2020 16:18:32 +0000

> open-source implementations.

According to reference [1], Nokia SROS implements TCP-AO as well. As far as I can see, RFC 5925 and RFC 5926 are explicitly listed as supported in [1].

So, apparently two major router vendors have running code for TCP-AO.

But this seems really off-topic for draft-ietf-taps-transport-security.

Michael

[1] Nokia SROS documentation at https://documentation.nokia.com/cgi-bin/dbaccessfilename.cgi/3HE15811AAAATQZZA01_V1_7450%20ESS%207750%20SR%207950%20XRS%20and%20VSR%20Basic%20System%20Configuration%20Guide%2020.2.R1.pdf

> Given the problem with TCP-AO deployment is that there is no free
> implementation and low implementation by vendors, how exactly would a new
> solution with even less implemented code help?
> 
> Joe
> _______________________________________________
> Taps mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/taps

---

From: "Susan Hares" <[email-masked]>
Date: Thu, 16 Apr 2020 12:55:29 -0400

Joe: 

I have come to the same conclusion that an open-source TCP-AO is the next
step for TCP-AO.

I still hoping for some fairy dust ... to fix the BGP TCP security problem. 
If you have any ... let me know 

Susan Hares

-----Original Message-----
From: Joseph Touch [mailto:[email-masked]] 
Sent: Thursday, April 16, 2020 11:32 AM
To: Susan Hares
Cc: [email-masked]; [email-masked];
[email-masked]; [email-masked]
Subject: Re: [Taps] Opsdir telechat review of
draft-ietf-taps-transport-security-11

Hi, Susan,

> TCP MD5 is bad (due to privacy issues) and TCP-AO is not deployed..

It is available in Cisco IOS at least. Its biggest drawback appears to be a
lack of open-source implementations.

Joe

---

From: Joseph Touch <[email-masked]>
Date: Thu, 16 Apr 2020 10:10:52 -0700

> On Apr 16, 2020, at 9:55 AM, Susan Hares <[email-masked]> wrote:
> 
> Joe: 
> 

We have a fix for the security problem. What we lack is a fix for the freeloader problem. 

Other than declaring TCP MD5 a hazard and actively abandoning it, there’s too much of a fallback.

One step might be for the IETF to prohibit support for TCP MD5 in all new work - e.g., there’s pending work in TCPM to develop a YANG model that includes MD5 “for legacy support”, but that only serves to feed the problem. 

But a new solution isn’t going to make freeloading easier.

Joe

---

From: "Susan Hares" <[email-masked]>
Date: Thu, 16 Apr 2020 13:19:10 -0400

+1 --- unfortunately for the social engineering on TCP-MD5
          Freeloading does not having impeding crisis 
          requiring BGP peer to have social distance from non-secure peer. 
          (smile) 

Sue

-----Original Message-----
From: Joseph Touch [mailto:[email-masked]] 
Sent: Thursday, April 16, 2020 1:11 PM
To: Susan Hares
Cc: [email-masked]; [email-masked]; [email-masked]; [email-masked]
Subject: Re: [Last-Call] [Taps] Opsdir telechat review of draft-ietf-taps-transport-security-11

> I have come to the same conclusion that an open-source TCP-AO is the 
> next step for TCP-AO.
> 

Joe