Subject: [savi] Your Vote: Protection Scope on Multi-SAVI-Device Links

From: Christian Vogt <[email-masked]>
Date: Sat, 11 Apr 2009 20:22:19 -0700

Folks -

At the SAVI meeting in San Francisco, we discussed issues related to
scenarios with multiple SAVI devices per link.  In such scenarios, the
lack of any coordination between the SAVI devices on a link would enable
an attacker to spoof an on-link address in certain cases [1].  The
reason is that, without coordination, SAVI devices may have incomplete
knowledge of the addresses bound by other SAVI devices on their link, so
they can reliably protect only those addresses that are bound by
themselves and, consequently, used in a local environment around them.

In San Francisco, we voted on whether people think that a local
protection scope per SAVI device would be sufficient, or whether people
wanted SAVI devices to provide link-wide protection.  The result at the
meeting was in favor of link-wide protection.  I would now like to
confirm this vote on this mailing list.

On links with multiple SAVI devices, what should the protection scope of
each SAVI device be?  Please choose one of the following:

(1) The protection scope should be link-wide for every SAVI device.

(2) The protection scope can be local for a SAVI device.

Please vote by Sunday, April 19, 2009.

Note that voting for option (1) may, but does not necessarily imply that
we need to devise an explicit "binding distribution protocol" for
scenarios with multiple SAVI devices.  It may be possible for SAVI
devices to coordinate implicitly, e.g., by listening to address
configuration traffic.  More analysis is needed to figure out how the
coordination could be realized best (and the discussion we had in San
Francisco already provided some very useful input to such an analysis).

- Christian

[1] SAVI Binding Distribution Protocol (presented by Marcelo Bagnulo)
     http://www.ietf.org/proceedings/09mar/slides/savi-1.pdf

---

From: marcelo bagnulo braun <[email-masked]>
Date: Sun, 12 Apr 2009 11:45:15 +0200

Hi,

My take on this is that it should be optional for savi devices to 
implement and to run the SAVI protocol (whether a SAVI verification 
protocol or a savi distribution protocol is a different discussion imho).

I mean, i think that there are some topologies where the is no need to 
exchange any information. The trivial example is the case with a single 
switch in the link, but there are more interesting topologies. For 
instance, it seems to me that in some of the topologies considered by 
the broadband forum, there wouldn't really be a need for exchanging 
information between the savi devices, due to the characteristics of the 
topology (but this needs to be analysed in further detail).

So, i think that running the savi protocol between devices should be a 
choice of the admin of the domain, based on the topology and the 
security level required.
That is, in some topologies, the desired level of security can be 
achieved without running exchanging information between devices, while 
in other this is not possible.

So, imho, what is needed is:
- An analysis of the security level that is possible to achieve 
depending on the topology.
- Define the protocol to exchange savi devices as an optional feature 
(probably in a different spec)

Regards, marcelo

Christian Vogt escribió:
> _______________________________________________
> savi mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/savi
>

---

From: "Jun Bi" <[email-masked]>
Date: Tue, 14 Apr 2009 00:16:16 +0800

----- Original Message ----- 
From: "Christian Vogt" <[email-masked]>
To: "SAVI Mailing List" <[email-masked]>
Sent: Sunday, April 12, 2009 11:22 AM
Subject: [savi] Your Vote: Protection Scope on Multi-SAVI-Device Links

> (1) The protection scope should be link-wide for every SAVI device.

Hi All,

Vote for (1).

Reason: If chose (2), it may cause severe problems. E.g. if SAVI device#1 
has
incomplete knowledge of the addresses bound by SAVI device#2 on their link,
then host A under SAVI device#1 may spoof the source address of host B who
is already bound under SAVI device#2.

> configuration traffic.

Agree with Christian's note, it is possbile for SAVI devices to coordinate
by snooping the control packets.

thansk,
Jun Bi