Subject: Issue 19) Security Considerations

From: Kunihiro Ishiguro <[email-masked]>
Date: Thu, 20 Mar 2003 21:01:40 -0800

>      Use of TCP MD5 [RFC2385] for authentication is mandatory.

Sorry for late comment.  When router has IPsec, the box can do TCP
authentication (IMHO IPsec is better than TCP MD5).  I'd like to
suggest to add a choice of IPsec not only TCP MD5.
-- 
Kunihiro Ishiguro

---

From: [email-masked]
Date: Thu, 20 Mar 2003 21:17:25 -0800

Since there is no standard specifying BGP over IPSEC, we should leave this
out of the base draft.  I know there has been work in this area, I believe
Dave Ward has/had a draft.  I can only find the withdrawn id info now, though.

I would suggest that we leave this out of the base draft, and if we 
later specify IPSEC, then we should add it in that draft. 

Andrew

On Thu, Mar 20, 2003 at 09:01:40PM -0800, Kunihiro Ishiguro wrote:
> Delivered-To: [email-masked]
> Delivered-To: [email-masked]
> Delivered-To: [email-masked]
> Date: Thu, 20 Mar 2003 21:01:40 -0800
> From: Kunihiro Ishiguro <[email-masked]>
> To: [email-masked]
> Subject: Issue 19) Security Considerations
> User-Agent: Wanderlust/2.10.0 (Venus) SEMI/1.14.3 (Ushinoya) FLIM/1.14.2 (Yagi-Nishiguchi) APEL/10.3 Emacs/21.2.92 (i686-pc-linux-gnu) MULE/5.0 (SAKAKI)
> Precedence: bulk
> X-Spam-Status: No, hits=-0.8 required=5
> X-Scanned-By: MIMEDefang 2.30 (www . roaringpenguin . com / mimedefang)
> X-OriginalArrivalTime: 21 Mar 2003 05:05:49.0351 (UTC) FILETIME=[89DE4370:01C2EF67]
>

---

From: Kunihiro Ishiguro <[email-masked]>
Date: Fri, 21 Mar 2003 12:26:13 -0800

>later specify IPSEC, then we should add it in that draft. 

Thanks for comment.  I think we shold take the security concern out of
the base draft and specify it separately.

You know MUST item in specification has strong power.  Before we put
TCP MD5 as only one MUST item in security concern section in BGP we
need to think about it.  It seems we have a plan to refer other draft
as detailed security considerations right?  Then I'd like to put
security concern into the draft.
-- 
Kunihiro Ishiguro

---

From: Curtis Villamizar <[email-masked]>
Date: Fri, 21 Mar 2003 15:56:24 -0500

> security concern into the draft.

I suggest that we leave the MUST in there because it reflects current
implementation and deployments and is not considered optional by any
of the ISPs.  The word MUST sends exactly the message it was intended
to send.

Curtis

---

From: Kunihiro Ishiguro <[email-masked]>
Date: Fri, 21 Mar 2003 13:11:29 -0800

>of the ISPs.  The word MUST sends exactly the message it was intended

Actually there are so many box which does not support TCP MD5.  I know
it becuase I believe I'm one of BGP protocol implementator ;-).

When BGP base specificatoin claim that TCP MD5 is MUST item,
implementors has to implement TCP MD5 only for BGP.  Even there are
alternative way to achieve security.

I understand we are working on current best practice but at the same
time it has strong influence to future development.  I think we should
be careful to put TCP MD5 as MUST in base specification.  In the long
run it could be wrong message.
-- 
Kunihiro Ishiguro

---

From: Curtis Villamizar <[email-masked]>
Date: Fri, 21 Mar 2003 16:38:31 -0500

> it becuase I believe I'm one of BGP protocol implementator ;-).

I'm familiar with zebra.  It is not deployed except as a toy on some
unix boxes and some wannabe routers.  That may not be a reflection on
the quality of the work, however zebra does not reflect the
requirements of fitting into current tier-1 ISP deployments.

It is a legitimate question whether current tier-1 deployments should
entirely drive the spec in this area.  If the answer is "no" then
perhaps the requirement for TCP MD5 could be loosenned a little.

> run it could be wrong message.

TCP MD5 is currently considered by ISPs to be an operation
requirement.  There is currently no evidence that I can see of a
transition from TCP MD5 to IPSEC.  At the most we can change the
wording to indicate that for security reasons as a practical matter
TCP MD5 currently MUST be implemented however IPSEC represents a
technical alternative in the future that has so far seen little or no
deployment as protection for BGP.

Curtis

---

From: [email-masked]
Date: Fri, 21 Mar 2003 14:05:59 -0800

I would suggest we leave the MUST simply from an interoperabilty standpoint.
We want to have a lowest common authentication denominator that all 
implementations do, so, at a minimum they will interopreate.  If the
implementation wants to implement IPSEC too, then great.  But since
MD5 is currently widely deployed, it makes more sense as the lowest common
denominator.

Andrew

On Fri, Mar 21, 2003 at 01:11:29PM -0800, Kunihiro Ishiguro wrote:
> Date: Fri, 21 Mar 2003 13:11:29 -0800
> To: [email-masked]
> Cc: [email-masked], [email-masked]
> Subject: Re: Issue 19) Security Considerations 
> In-Reply-To: <[email-masked]>

---

From: Kunihiro Ishiguro <[email-masked]>
Date: Fri, 21 Mar 2003 14:23:42 -0800

>perhaps the requirement for TCP MD5 could be loosenned a little.

I believe BGP protocol is not only for tier-1 deployments.  BGP is
used from very small network to large network in various kind of
situation today.  For example countless RFC2547bis CE client connect
to PE using BGP for VPN services.

Again BGP is not only for tier-1 network based upon Cisco and Juniper
today.  There are so many other situations.

BGP security consideration is very important issue.  Just making TCP
MD5 MUST does not solve the problem.  I still suggest to separate this
issue from base BGP spec.
-- 
Kunihiro Ishiguro