Subject: Re: [RPSEC] [Fwd: Fwd: draft-behringer-bgp-session-sec-req-02.txt]

From: "Michael H. Behringer" <[email-masked]>
Date: Thu, 23 Aug 2007 12:42:02 +0200

Joe, thanks for your comments, appreciated! 

Inline...

At 09:25 23/08/2007, Joe Touch wrote:
>Russ White wrote:
>> 
>>> Please find the updated version of the session security requirements draft at 
>>> http://tools.ietf.org/html/draft-behringer-bgp-session-sec-req-02
>> 
>> Quick straw poll--who would support taking this document, with the
>> current changes Michael has made in it, as a WG doc? Have all or most of
>> the objections been handled?
>
>I am still unclear what the purpose of this document will be:
>
>        - BCP
>                e.g., configuration recommendations and
>                suggestions for selecting protocols or mechanisms
>                that together protect BGP
>
>        - problem and applicability statement
>                e.g., requirements for a new protocol or change
>                to an existing protocol
>
>Without knowing that, it's difficult to answer the question posted.

The goal is *not* BCP for operators, it is requirements for new protocols, as defined in the WG charter. The document fits specifically into those two tasks of the charter: 

- Document security requirements for routing systems

- Document security analysis and requirements for specific routing
    protocols (e.g., OSPF, BGP)

Section 1 tries to clarify this:  
"
   This document expands on this
   particular aspect of BGP security, defining the security requirements
   between two BGP peers.
"
and at the end
"
   This document lists the requirements for BGP session security, with
   the goal to provide a guideline for flexible, operationally
   manageable, and secure algorithms for BGP session protection.
"
I guess I could *explicitely* exclude the BCP. Would that address your concerns? If not, can you suggest what would? 

Thanks again for the feedback!
Michael

PS: It appears this is the only "show-stopper" to make the doc a WG doc; I'll address the other questions/comments mentioned in your postscriptum later. (Thanks for those as well - good comments!)

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Joe Touch <[email-masked]>
Date: Thu, 23 Aug 2007 07:41:45 -0700

Notes below...

Michael H. Behringer wrote:
> The goal is *not* BCP for operators, it is requirements for new
> protocols, as defined in the WG charter. The document fits specifically
> into those two tasks of the charter:
> 

Requirements inside the routing protocols, or at other layers? If the
former, it's a requirements doc; the latter is either a BCP (of the use
of existing protocols at other layers) or call for the rest of the IETF
to address this problem together. Only the first appears to be defined
in the WG charter.

>     protocols (e.g., OSPF, BGP)

This could be interpreted any of the three ways noted just above.

> I guess I could *explicitely* exclude the BCP. Would that address your
> concerns? If not, can you suggest what would? 

The document currently focuses on issues which are not at the BGP
session level; it notes the specific use of IP address as BGP session ID
and the need to protect that ID (which is a network layer issue, and is
addressed by IPsec), the use of TTL for DOS protection (another network
layer issue having nothing to do with protecting BGP sessions per se),
and a lot about transport layer issues (which TCPM is already
addressing, and already has a problem/applicability statement for).

IMO, to make this a requirements document for BGP session protection,
the document needs to limit its discussion to properties at the BGP
layer; it needs substantial revision to make that clear and limit that
focus. The statements above are insufficient, since they could be (have
been, and are being) addressed at other layers of the protocol stack.

Joe

-- 
----------------------------------------------------------------------
Joe Touch                Sr. Network Engineer, USAF TSAT Space Segment
               Postel Center Director & Research Assoc. Prof., USC/ISI