Subject: [Rserpool] Minutes of security design team teleconference - April 4

From: [email-masked]
Date: Wed, 9 Apr 2003 13:07:15 -0500

For a summary of open security issues please see the talk entitled "Rserpool Security" presented at IETF #56: www.ietf.org/proceedings/03mar/slides/reserpool-3/index.html

The next security design team teleconference will be held on Tuesday, April 15 at 10AM EDT USA.  Note that the US has gone to daylight savings time.

Summary of April 4:

This was attended by:
Michael Tuexen
Aron Silverton
Qiaobing Xie
Maureen Stillman

The security design team reached consensus on using TLS from the PE to the ENRP server and between ENRP servers to guarantee the following properties:
1) the integrity of the nameserver information sent from the ENRP server to the client
2) the integrity of the registration information sent from the PE to the ENRP server
3) ensuring that a PE registers with a legitimate (non-rogue) ENRP server

The open issue that this raised is:

What about ENRP servers that have both: PE registrations using TLS and PE registrations not using TLS?
There were two options discussed:

1) PE registration entries that had used TLS would be flagged as such.  The ENRP server would pass along a list to the PU with some entries marked as "secure" and others marked as not.
2) An ENRP server that supports security would only accept PE input that used TLS.  All other registrations would be rejected.  Then, when the PU requests a list, it would have only secure entries. 

The reason to support #1 is that it lets the PU decide what entries to trust.
The reason to support #2 is simplicity and support for a consistent security policy.  Don't want to fragment the namespace.

There was more support for #2 than for #1 and we agreed to ask the mailing list for an opinion.   

Comments on this?

There was a question about having two separate ports for the ENRP server PE registration, one for TLS security, and the other for no security.  Someone raised the issue that using two separate ports is deprecated.  Using two different ports would be simpler from an implementation point of view.  However, using one port has security issues and is more complex to implement and get it right.  Maureen Stillman agreed to contact Eric Rescorla to find out the current IESG/IAB thinking on this issue.  His response will be posted to the mailing list.

Any corrections/additions to the minutes?

-- maureen  

_______________________________________________
rserpool mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rserpool