Subject: Re: Issue 19) Security Considerations

From: Curtis Villamizar <[email-masked]>
Date: Wed, 26 Mar 2003 19:45:16 -0500

In message <20030325205614.A1596@verdi>, John Leslie writes:
>  
>    I'm not at all wedded to the words I proposed, but if we can't find
> somewhere in this document to say that TCP-MD5 "should" be used, I think
> we have no business saying it "must" be implemented.

We don't need that in the protocol spec.  Protocol specs are not
supposed to dictate usage.  This keeps them simpler.  Usage
recommendations and implementation experience is provided in separate
documents, not in the protocol spec.

>    If, instead, we claim that it's entirely up to administrators
> whether to use TCP-MD5, and we have no recommendation, I don't see how
> we justify denying them access to implementations which don't include
> TCP-MD5.

Putting something into a spec doesn't deny access to anything.  By
mandating TCP MD5 in the security section we just indicate that
implementations without it have a very severe deficiency with regard
to meeting security requirements in a way that interoperates with the
existing installed base.

Curtis

---

From: "Joris Dobbelsteen" <[email-masked]>
Date: Thu, 27 Mar 2003 09:18:45 +0100

Indeed, for recommendation, TCP-MD5 would be at least a
sufficient minimum, because it is widely implemented.

Still it should mention what vulnerabilities are kept open
even when using TCP-MD5, so they can be taken into account
in the future and in current deployments...

- Joris

>-----Original Message-----
>From: [email-masked] [mailto:[email-masked]]On Behalf Of
>Curtis Villamizar
>Sent: Thursday, 27 March 2003 1:45
>To: John Leslie
>Cc: Curtis Villamizar; Alex Zinin; [email-masked]
>Subject: Re: Issue 19) Security Considerations 
>
>
>

---

From: Curtis Villamizar <[email-masked]>
Date: Thu, 27 Mar 2003 12:52:19 -0500

In message <[email-masked]>, "Joris Dobbelsteen" 
> in the future and in current deployments...

That's fair.  Name those vulnerabilities and how they apply to use of
TCP MD5 for BGP where snooping is generally not possible and we'll put
them in.

It might also be worth mentioning the DoS issues, the use of filtering
to solve these problems, and the inability to do that filtering with
security protocols which hide the port numbers.

If we decide to do this any of a number of people could supply the
latter but I'd be willing to.

Curtis