Subject: [RPSEC] [Fwd: Fwd: draft-behringer-bgp-session-sec-req-02.txt]

From: Russ White <[email-masked]>
Date: Tue, 21 Aug 2007 16:17:19 -0400

>Please find the updated version of the session security requirements draft at 
>http://tools.ietf.org/html/draft-behringer-bgp-session-sec-req-02

Quick straw poll--who would support taking this document, with the
current changes Michael has made in it, as a WG doc? Have all or most of
the objections been handled?

Thanks!

:-)

Russ

- --
[email-masked] CCIE <>< Grace Alone

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Geoff Huston <[email-masked]>
Date: Wed, 22 Aug 2007 06:59:22 +1000

> the objections been handled?

I support this

Geoff

---

From: Joe Touch <[email-masked]>
Date: Thu, 23 Aug 2007 00:25:51 -0700

> the objections been handled?

I am still unclear what the purpose of this document will be:

	- BCP
		e.g., configuration recommendations and
		suggestions for selecting protocols or mechanisms
		that together protect BGP

	- problem and applicability statement
		e.g., requirements for a new protocol or change
		to an existing protocol

Without knowing that, it's difficult to answer the question posted.

Joe

PS: There are other issues which were already pointed out and have not
been addressed:

	- layer of focus
		the threat model list is all over the place;
		is this intended to be network, transport,
		or routing protocol layer focused?

	- the protection of GTSM
		given GTSM, all we can say is that the packets
		have passed through a device one hop away;
		that hop could maliciously spoof the TTL of
		sources many further hops away
	
	as a notion of 'threat source', IPsec or TCP-MD5 are better
	examples of source identification
	
	- the abstract continues to refer to a section on transport
	layer protection that does not exist

		further, I disagree that the abstract is accurate
		in asserting that this isn't about transport;
		nearly the entirety of the doc is posed in transport
		terms

	- there are relevant citations missing:
		draft-touch-tcpm-tcp-simple-auth-03.txt as a alternate
		auth mechanism to TCP/MD5

		rfc4953 in discussing the need for BGP to incorporate
		transport layer protection; this is notable in that
		the doc discusses the specific need for TTL checking
		for DOS mitigation, but does not discuss the issue
		of the need for transport protection per se.

-- 
----------------------------------------------------------------------
Joe Touch                Sr. Network Engineer, USAF TSAT Space Segment
               Postel Center Director & Research Assoc. Prof., USC/ISI

---

From: Ron Bonica <[email-masked]>
Date: Thu, 23 Aug 2007 10:42:34 -0400

Folks,

I support adopting this document as a WG item, but recommend a couple of
changes:

- the document should task the transport area with the development of a
mechanism that addresses the shortcomings of RFC 2385

- draft-touch-tcpm-tcp-simple-auth should be sited as that mechanism. It
is the successor to draft-bonica-tcp-auth.

- references to draft-bonica-tcp-auth should be removed

                                     Ron

Joe Touch wrote:
> ------------------------------------------------------------------------
>

---

From: Joe Touch <[email-masked]>
Date: Thu, 23 Aug 2007 07:47:19 -0700

> mechanism that addresses the shortcomings of RFC 2385

Procedurally, I don't see why a WG needs a document to do this,
especially when it's already underway ;-)

I agree with Ron's position, but the key question is whether - if this
is the primary or sole goal of this doc - it should be developed as a WG
item; it'd be better to focus the review of the problem statement and
solution in the TCPM group unless there are multiple protocols needed,
at which point again I don't quite understand whether this WG needs to
develop or issue a document to move this issue forward.

Joe

---

From: Stephen Kent <[email-masked]>
Date: Thu, 23 Aug 2007 15:01:33 -0400

The document needs a lot of changes, as the edits and comments in the 
attachment show.

Steve

---

From: Russ White <[email-masked]>
Date: Thu, 23 Aug 2007 16:56:03 -0400

> develop or issue a document to move this issue forward.

The logic behind this would be we want to make certain routing protocol
requirements are met, as well as any generic TCP requirements. If there
are no requirements BGP would place beyond the "normal" TCP
requirements, or the TCPM WG doesn't feel the need to input from the
routing community, then we may not need this doc.

In general, though, a lot of folks I've talked to thought it was a good
idea for the routing community to provide input into the docs being
worked on in the Transport area.

:-)

Russ

- --

---

From: Joe Touch <[email-masked]>
Date: Thu, 23 Aug 2007 14:03:30 -0700

> worked on in the Transport area.

I agree entirely; it might be useful to have this document focus on
non-transport issues, and cite the other document as addressing those,
rather than having a separate document addressing BGP transport
requirements.

I.e., the best place to add BGP-specific transport requirements would be
in Bellovin's doc, rather than a separate doc from a separate WG.

Joe

---

From: Russ White <[email-masked]>
Date: Thu, 23 Aug 2007 17:25:59 -0400

>> In general, though, a lot of folks I've talked to thought it was a
>> good idea for the routing community to provide input into the docs
>> being worked on in the Transport area.
> 
> non-transport issues, and cite the other document as addressing
> those, rather than having a separate document addressing BGP
> transport requirements.

Two questions:

1. What does the rest of the WG think about this?

> I.e., the best place to add BGP-specific transport requirements would
>  be in Bellovin's doc, rather than a separate doc from a separate WG.
> 
This is specifically what I'm not certain about.... Should the TCPM docs
contain generic transport related requirements, or generic requirements?

2. What would you change to make the doc acceptable, if this is the
direction to go?

:-)

Russ

- --

---

From: Geoff Huston <[email-masked]>
Date: Fri, 24 Aug 2007 07:58:05 +1000

> 		e.g., requirements for a new protocol or change

The RPSEC charter has the following:

The RPSEC working group is charged with the following tasks:

...

- Document security analysis and requirements for specific routing
     protocols (e.g., OSPF, BGP)

I remain of the view that this document sits easily within the RPSEC 
charter, and yes, Joe, there are elements of the document that appear to 
have some potential for discussion and review in the context of the 
working group, as your specific comments illustrate.

regards,

   Geoff

---

From: Stephen Kent <[email-masked]>
Date: Fri, 24 Aug 2007 09:52:27 -0400

At 5:25 PM -0400 8/23/07, Russ White wrote:
>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA1
>
>

I think having a routing-specific security requirements document for 
point-to-point communication is useful, and a reasonable adjunct to 
the work being done in the Transport area.

>2. What would you change to make the doc acceptable, if this is the

I've suggested a number of edits that I think would yield a better document.

Steve