Subject: RE: [Isis-wg] RE: draft-ietf-isis-hmac-03.txt

From: Jeff Parker <[email-masked]>
Date: Tue, 8 Apr 2003 14:05:39 -0400

> From what you can tell thats the summ of my discussion ? 
> 
> This guy showed a deeper knowledge for operations as 
> well as the true security implications to include real 
> risk-mitigation. Which concretely conludes that he is 
> profoundly knowledgable of the technology.
>
> Will
> 
> > So you're suggesting that we trust source addresses?
> 
> > Tony
> 
> 
> |    -----Original Message-----
> |    From: Ferrell, William [mailto:[email-masked]] 
 
> |    I agree that there are many mitigation techniques the 
> |    simplest of course is to ACL with only trusted peers.  

Will -
	I can't speak for Tony, but suspect that this was the
comment he was responding to.  In the case of an IGP, the
peers are machines, and all we have to judge them by are
some bits in a packet.  As you know, those are easy to 
fake.  

	Currently, IS-IS is deployed in some important spots.
Any change to IS-IS that involves large changes is a non-
starter.  Thus security changes that involve major changes
in the protocol are out of the question.  We don't have 
the luxury of starting over.  

	You might get more traction if you start out with 
some specific suggestions.  These documents are not RFCs
yet, and improvement is always possible.  But suggesting
that the authors don't understand operations or security
isn't likely to get you very far.  

- jeff parker
- You can catch more flies with honey than with vinegar
_______________________________________________
Isis-wg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isis-wg