Subject: [nvo3] comments on nvo3 security requirements draft

From: ramki Krishnan <[email-masked]>
Date: Thu, 5 Dec 2013 16:50:05 -0800

Dear Co-authors,

Please find comments on the nvo3 security requirements draft below.

>>REQ2: (Page 8)
This should recommend some authorization mechanisms such as md5 checksum.

>>REQ3: (Page 8)
>>b: The signaling packets SHOULD be encrypted.
We believe encryption should be an optional feature, since encryption impacts performance. This is okay as long as Authentication (REQ1) and Authorization (REQ2) are met.

>>5.1.1 Data Plane
Need additional requirements for tenant performance isolation so that one errant tenant does not affect the other; for example, if one tenant is facing an abnormal amount of traffic due to a behavioral security threat such as DDoS attack, it should not affect the performance of other tenants in a virtualized environment. We would be glad to provide additional text for this.

Thanks,
Ramki & Anoop

---

From: Melinda Shore <[email-masked]>
Date: Thu, 05 Dec 2013 16:55:09 -0900

> This should recommend some authorization mechanisms such as md5 checksum.

I agree with your other suggestions, but 1) I don't think a
requirements document should be making specific technology
recommendations, and 2) md5 provides some assurances about
message integrity, but really has nothing to say about
policy.  In rereading the requirement I think it's actually
not as clear as it could be although I think its intent is
absolutely correct.  I'd probably change the text to something
along the lines of:

"Before accepting a control packet, the device receiving
the packet MUST verify that the device sending the request
is authorized to make that request.  This is a policy
decision."

Melinda

---

From: ramki Krishnan <[email-masked]>
Date: Thu, 5 Dec 2013 21:25:50 -0800

Thanks Melinda, agreed.

Thanks,
Ramki

-----Original Message-----
From: nvo3 [mailto:[email-masked]] On Behalf Of Melinda Shore
Sent: Thursday, December 05, 2013 5:55 PM
To: [email-masked]
Subject: Re: [nvo3] comments on nvo3 security requirements draft

> This should recommend some authorization mechanisms such as md5 checksum.

I agree with your other suggestions, but 1) I don't think a requirements document should be making specific technology recommendations, and 2) md5 provides some assurances about message integrity, but really has nothing to say about policy.  In rereading the requirement I think it's actually not as clear as it could be although I think its intent is absolutely correct.  I'd probably change the text to something along the lines of:

"Before accepting a control packet, the device receiving the packet MUST verify that the device sending the request is authorized to make that request.  This is a policy decision."

Melinda

_______________________________________________
nvo3 mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/nvo3

---

From: Truman Boyes <[email-masked]>
Date: Fri, 6 Dec 2013 15:30:32 -0500

I would recommend against suggesting MD5 as the hashing technology in a
text to be used for future development. If necessary to describe the
technology, I would recommend SHA-256(sha2) or SHA-512. This would not have
the same issues of collisions as MD5 currently does.

---

From: "Black, David" <[email-masked]>
Date: Fri, 6 Dec 2013 20:26:28 -0500

+1 - new specifications should definitely not be using MD5, and the SHA-2 hashes are preferable to SHA-1.

A useful related reference is NIST SP 800-131A: http://csrc.nist.gov/publications/nistpubs/800-131A/sp800-131A.pdf

Thanks,
--David

From: nvo3 [mailto:[email-masked]] On Behalf Of Truman Boyes
Sent: Friday, December 06, 2013 3:31 PM
To: Melinda Shore
Cc: [email-masked]
Subject: Re: [nvo3] comments on nvo3 security requirements draft

I would recommend against suggesting MD5 as the hashing technology in a text to be used for future development. If necessary to describe the technology, I would recommend SHA-256(sha2) or SHA-512. This would not have the same issues of collisions as MD5 currently does.

On Thu, Dec 5, 2013 at 8:55 PM, Melinda Shore <[email-masked]<mailto:[email-masked]>> wrote:

Melinda

_______________________________________________
nvo3 mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/nvo3

---

From: Melinda Shore <[email-masked]>
Date: Fri, 06 Dec 2013 16:30:00 -0900

> SHA-2 hashes are preferable to SHA-1.

Well sure, but again, technology specifications don't
belong in a requirements document.

Melinda

---

From: "Zhangdacheng (Dacheng)" <[email-masked]>
Date: Mon, 9 Dec 2013 05:52:17 +0000

Hi, Thanks a lot for the comments. ^_^ I am working on the document and trying to integrate the comments collected recently into it. I will propose the updated draft to the list after finishing it.

Cheers

Dacheng

> Sent: Saturday, December 07, 2013 9:30 AM
> To: Black, David
> Cc: Truman Boyes; [email-masked]