Subject: RE: Issue 19) Security Considerations

From: "Susan Hares" <[email-masked]>
Date: Fri, 28 Mar 2003 08:42:49 -0500

Curtis:

My understanding is that this is an addition
to the security vulnerabilities document. 

Is this correct?

Sue

-----Original Message-----
From: Curtis Villamizar [mailto:[email-masked]]
Sent: Thursday, March 27, 2003 12:52 PM
To: Joris Dobbelsteen
Cc: IDR WG (E-mail)
Subject: Re: Issue 19) Security Considerations 

In message <[email-masked]>, "Joris Dobbelsteen" 
writes:
> Indeed, for recommendation, TCP-MD5 would be at least a
> sufficient minimum, because it is widely implemented.
> 
> Still it should mention what vulnerabilities are kept open
> even when using TCP-MD5, so they can be taken into account
> in the future and in current deployments...
> 
> - Joris

That's fair.  Name those vulnerabilities and how they apply to use of
TCP MD5 for BGP where snooping is generally not possible and we'll put
them in.

It might also be worth mentioning the DoS issues, the use of filtering
to solve these problems, and the inability to do that filtering with
security protocols which hide the port numbers.

If we decide to do this any of a number of people could supply the
latter but I'd be willing to.

Curtis

> >-----Original Message-----
> >From: [email-masked] [mailto:[email-masked]]On Behalf Of
> >Curtis Villamizar
> >Sent: Thursday, 27 March 2003 1:45
> >To: John Leslie
> >Cc: Curtis Villamizar; Alex Zinin; [email-masked]
> >Subject: Re: Issue 19) Security Considerations 
> >
> >
> >
> >In message <20030325205614.A1596@verdi>, John Leslie writes:
> >>  
> >>    I'm not at all wedded to the words I proposed, but if we 
> >can't find
> >> somewhere in this document to say that TCP-MD5 "should" be 
> >used, I think
> >> we have no business saying it "must" be implemented.
> >
> >We don't need that in the protocol spec.  Protocol specs are not
> >supposed to dictate usage.  This keeps them simpler.  Usage
> >recommendations and implementation experience is provided in separate
> >documents, not in the protocol spec.
> >
> >>    If, instead, we claim that it's entirely up to administrators
> >> whether to use TCP-MD5, and we have no recommendation, I 
> >don't see how
> >> we justify denying them access to implementations which don't include
> >> TCP-MD5.
> >
> >Putting something into a spec doesn't deny access to anything.  By
> >mandating TCP MD5 in the security section we just indicate that
> >implementations without it have a very severe deficiency with regard
> >to meeting security requirements in a way that interoperates with the
> >existing installed base.
> >
> >Curtis

---

From: Curtis Villamizar <[email-masked]>
Date: Sat, 29 Mar 2003 15:56:16 -0500

In message <[email-masked]
> to the security vulnerabilities document. 

We are talking about the security section of the BGP4 internet draft.

Curtis

---

From: Curtis Villamizar <[email-masked]>
Date: Sat, 29 Mar 2003 17:14:17 -0500

In message <[email-masked]>, Curtis Villamizar 
> We are talking about the security section of the BGP4 internet draft.

Maybe I should clarify that.

We all know that TCP in the clear has vulnerabilities.  Use of MD5
increases the barrier to exploit these.  If snooping is not possible,
MD5 is completely effective in this role.

There is a second set of vulnerabilities having to do with DoS.  An
attacker can send traffic faster than the authentication can be run to
throw it away.  Packet filtering techniques have been used to reduce
the exposure and in some cases eliminate it.

A short description (a bit more than these two paragraphs) may be
needed in the BGP4 spec.  If you want I'll write something (Monday).

Curtis

> > In message <[email-masked]>, "Joris Dobbelste
> en
> > " 
> > writes:

---

From: Yakov Rekhter <[email-masked]>
Date: Mon, 31 Mar 2003 06:17:04 -0800

Curtis,

> > >, "Susan Hares" writes:

May I suggest that the proper place for this would be in the BGP
Vulnerabilities Analysis document. The base spec already has a
pointer to that document.

Yakov.

---

From: Curtis Villamizar <[email-masked]>
Date: Mon, 31 Mar 2003 10:01:37 -0500

In message <[email-masked]>, Yakov Rekhter writes
> pointer to that document.

OK.  I'll send something to Sandy and she can decide what to use or
whether to use it.

Curtis