Subject: Re: [OPSEC] draft-ietf-opsec-routing-protocols-crypto-issues-00.txt

From: RJ Atkinson <[email-masked]>
Date: Tue, 24 Feb 2009 12:02:23 -0500

Hi,

Has the draft been revised to take into account my previous comments  
here ?
If that hasn't happened yet, that is probably a first step to take,
ideally before the I-D cutoff for the next IETF meeting.

Cheers,

Ran
[email-masked]

---

From: RJ Atkinson <[email-masked]>
Date: Tue, 24 Feb 2009 12:28:06 -0500

On  24 Feb 2009, at 12:22, Bhatia, Manav (Manav) wrote:
> Weren't your comments addressed to the minutes that were posted on  
> the list?

The minutes discussing the drafts -- so they apply also
to the drafts.   I think revised I-Ds taking those
comments into consideration would be very helpful.

Thanks,

Ran

---

From: "Bhatia, Manav (Manav)" <[email-masked]>
Date: Tue, 24 Feb 2009 23:05:31 +0530

Hi Ran,

AFAIK you had not given any comments wrt this draft. Weren't your comments addressed to the minutes that were posted on the list?

Anyways, would be great if you can summarize what you want to see added to this draft.

Cheers, Manav 

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] 
> On Behalf Of RJ Atkinson
> Sent: Tuesday, February 24, 2009 10.32 PM
> To: [email-masked]
> Subject: Re: [OPSEC] 
> draft-ietf-opsec-routing-protocols-crypto-issues-00.txt
> 
> Hi,
> 
> _______________________________________________
> OPSEC mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/opsec
>

---

From: Glen Kent <[email-masked]>
Date: Tue, 24 Feb 2009 23:13:36 +0530

Hmm .. interesting how you keep changing your position. You had said the
following just a few weeks back:

> On Behalf Of R Atkinson
> Sent: Thursday, December 18, 2008 7.27 AM
> To: [email-masked]
> Subject: Re: [OPSEC] minutes part 2
>
>
> On  17 Dec 2008, at 20:04, Glen Kent wrote:
> > This does not address the point that i had raised.
> >
> >> I have no concern with the WG documenting any issues, provided:
> >> - they really are technical issues rather than opinion,
> >
> > So, you dont think the issues mentioned in the drafts are technical?
> > OK, how would you categorize those issues?
>
*> Let me repeat:
> My comments here have been focused on the
> comments reported *meeting minutes*.
>
> I have made no assertions about any drafts.*

On Tue, Feb 24, 2009 at 10:58 PM, RJ Atkinson <[email-masked]>
wrote:
>> Weren't your comments addressed to the minutes that were posted on the
list?
*> The minutes discussing the drafts -- so they apply also
> comments into consideration would be very helpful.
*>
> Ran

Glen

---

From: "Bhatia, Manav (Manav)" <[email-masked]>
Date: Wed, 25 Feb 2009 09:09:03 +0530

Ran,

I went through the archives for your comments on this draft (draft-ietf-opsec-routing-protocols-crypto-issues-00.txt) and could only find one, where you suggested that we must also include a study of OSPF with digital signatures in this draft. Is this all, or am I missing something? 

Most of the discussion in the past was around whether the WG is correct in recommending HMAC-SHA over MD5/HMAC-MD5 or not. If you still want to address this issue then please use a different thread, as that's related to the other draft (draft-bhatia-manral-igp-crypto-requirements) and not the one that this email is originally about.

Cheers, Manav

> Sent: Tuesday, February 24, 2009 10.58 PM
> To: [email-masked]
> Subject: Re: [OPSEC]

---

From: RJ Atkinson <[email-masked]>
Date: Thu, 26 Feb 2009 11:25:06 -0500

On  24 Feb 2009, at 22:39, Bhatia, Manav (Manav) wrote:
>  Is this all, or am I missing something?

As the minutes combined multiple drafts, so the responses
(which were driven by the minutes) combined multiple drafts;
that was unavoidable from the situation. :-(

(Aside: I did sit down and read the drafts when I had time
last month.  Not surprisingly I found that the comments
driven by the minutes also applied to the drafts.)

Several items on this draft are discussed here:
    <http://www.ietf.org/mail-archive/web/opsec/current/msg00291.html>

Also see the top section (with "-" markers) of this note:
    <http://www.ietf.org/mail-archive/web/opsec/current/msg00298.html>
A documented Threat Model is particularly needed, as that
provides a sound basis for the other security evaluation.

Here, in (1) the issue of also addressing RFC-2154 (which is
also an openly specified mechanism for OSPF cryptographic
authentication) came up.  Separately, in (2) a recurring gap
is that the authors appear to know of a case (or cases)
where filtering of RIP or OSPF packets at the edge of
an IGP domain can't work.  One can't figure out if that is
true, or when/where/how it is true, simply because sufficient
detail hasn't been provided.  So having one or two
*very detailed* examples that clarify when/why/how edge
filtering of RIP or OSPF packets is not feasible (as was
claimed) would be really important to operators, and
would help clarify and support some of the other claims
made in the document:
    <http://www.ietf.org/mail-archive/web/opsec/current/msg00300.html>

This last item is also important to clarify the Threat Model
(noted above).  If no deployments can fully filter at the edge,
then external attacks are a big part of the Threat Model.
If all deployments can fully filter at the edge, then external
attacks aren't a big issue and the focus is on the insider
threat.  If one sometimes can and sometimes can't filter at
the IGP domain edge, then both insider and external attacks
need to be considered -- AND operators need to understand
when/how/why IGP domain edge filtering does or doesn't work.

Please note that neither this response,
   <http://www.ietf.org/mail-archive/web/opsec/current/msg00301.html>
nor the threads pointed to by the URLs in that response
have sufficient detail to make clear the filtering issue.
There might be a real issue.  If there is one, it needs
to be documented in a clear and detailed way in the document.

Separate from me, Donald Smith noted the potential "DOS
vector" with IGP cryptographic authentication, and a
mitigation for that (GTSM):
   <http://www.ietf.org/mail-archive/web/opsec/current/msg00355.html>
I don't recall if that is in the current draft or not;
if not, both items he mentions are worth adding to the list.

There should also be some mention of non-cryptographic
attacks that are (1) easy to mount and (2) not eliminated
by any of the cryptographic authentication mechanisms;
attackers generally are both smart and lazy, so use
the lowest-cost-to-the-attacker attacks first.  It is
entirely possible that the draft already discusses some
or all of these; I'm not sure off hand and I'm travelling
just now.

So I'd like to see a revised I-D when your time permits.

Yours,

Ran
[email-masked]