Subject: [karp] PIM-SM Gap Analysis

From: "Bhatia, Manav (Manav)" <[email-masked]>
Date: Wed, 13 Apr 2011 23:23:10 +0530

Hi,

I have written a small draft that does security gap analysis for PIM-SM. I don't think its complete yet and could definitely do with some review from the KARP and the PIM WGs.

URL for the draft:
http://www.ietf.org/id/draft-bhatia-karp-pim-gap-analysis-00.txt

Cheers, Manav

--
Manav Bhatia,
Service Router Product Group (SRPG)
Alcatel-Lucent, India

---

From: Venkatesh Sriram <[email-masked]>
Date: Fri, 15 Apr 2011 05:58:40 +0530

Essentially what this draft says is that we need to get rid of IPsec
as its unmanageable and people are not using it for securing PIM-SM. I
agree to the latter part about people not using it for securing PIM-SM
but not sure if you'll have enough people agreeing to the IPsec part -
especially here in this WG! ;-)

There has been work happening in OSPF WG on similar lines (replacing
IPsec with some in-band mechanism) which has had significant support,
so there are several people who echo this sentiment.

Sriram

On Wed, Apr 13, 2011 at 11:23 PM, Bhatia, Manav (Manav)
<[email-masked]> wrote:
> _______________________________________________
> karp mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/karp
>

---

From: Michael Barnes <[email-masked]>
Date: Thu, 14 Apr 2011 17:41:51 -0700

> IPsec with some in-band mechanism) which has had significant support,

Just a PoI regarding OSPFv3: I want to point out that IPsec will not be 
*replaced* by the new authentication mechanism, it's just another 
option. And folks *are* using IPsec to secure OSPFv3.

Regards,
Michael

---

From: Venkatesh Sriram <[email-masked]>
Date: Fri, 15 Apr 2011 06:29:29 +0530

Yes, thats correct. I did not mean, as much as it appears from my
mail, that IPsec will be entirely replaced by the new authentication
mechanism. I am sure both will co-exist till there is enough
motivation to move from one to the other. While there are several
IPsec OSPFv3 deployments, i am not sure if you'll see the same number
for PIM-SM.

Sriram

On Fri, Apr 15, 2011 at 6:11 AM, Michael Barnes <[email-masked]> wrote:
> *replaced* by the new authentication mechanism, it's just another option.
> And folks *are* using IPsec to secure OSPFv3.
>
> Regards,
> Michael

---

From: Manav Bhatia <[email-masked]>
Date: Fri, 15 Apr 2011 09:29:08 +0530

Hi Sriram,

[clipped]

> IPsec OSPFv3 deployments, i am not sure if you'll see the same number

That could probably be because RFC 5796 is just a year old, while RFC 
4522 has been out there since almost 5+ years now.

Cheers, Manav

---

From: Glen Kent <[email-masked]>
Date: Tue, 19 Apr 2011 03:40:02 +0530

Manav,

> That could probably be because RFC 5796 is just a year old, while RFC 4522
> has been out there since almost 5+ years now.

A very valid point about why IPsec may not be as pervasively used with
PIM-SM as OSPFv3.

However, this also means that its a lot easier for us to get rid of
this and come out with an in-band security mechanism for PIM-SM or
PIM-SSM. Its really the latter that i am more interested in.

BTW, you should mention PIM-SSM in the design-guide as it may simplify
the KMP requirements when compared to PIM-SM. Even if an in-band
mechanism is developed then doing this for PIM-SSM is going to be much
simpler as you will not need to add a digest to the notorious PIM
register data packets.

Glen