Re: [Anima-bootstrap] Can the proxy add information during bootstrap?

Michael Richardson <mcr+ietf@sandelman.ca> Wed, 13 April 2016 12:53 UTC

Return-Path: <mcr+ietf@sandelman.ca>
X-Original-To: anima-bootstrap@ietfa.amsl.com
Delivered-To: anima-bootstrap@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3AC9D12E1EE for <anima-bootstrap@ietfa.amsl.com>; Wed, 13 Apr 2016 05:53:11 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.897
X-Spam-Level:
X-Spam-Status: No, score=-2.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.996, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Kbrq-HmZFgke for <anima-bootstrap@ietfa.amsl.com>; Wed, 13 Apr 2016 05:53:09 -0700 (PDT)
Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A511812E1F8 for <anima-bootstrap@ietf.org>; Wed, 13 Apr 2016 05:53:09 -0700 (PDT)
Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id 726D72002A; Wed, 13 Apr 2016 08:57:04 -0400 (EDT)
Received: from obiwan.sandelman.ca (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 28CC763755; Wed, 13 Apr 2016 08:53:08 -0400 (EDT)
From: Michael Richardson <mcr+ietf@sandelman.ca>
To: Brian E Carpenter <brian.e.carpenter@gmail.com>
In-Reply-To: <570D96FE.1000105@gmail.com>
References: <5c12b5d6940d4970bd3c0ad4c94b4696@XCH-RCD-006.cisco.com> <14252.1460506458@obiwan.sandelman.ca> <570D96FE.1000105@gmail.com>
X-Mailer: MH-E 8.6; nmh 1.6+dev; GNU Emacs 24.4.2
X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m<nPbLgmtKK-5dC@#:k
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-="; micalg="pgp-sha1"; protocol="application/pgp-signature"
Date: Wed, 13 Apr 2016 08:53:08 -0400
Message-ID: <16660.1460551988@obiwan.sandelman.ca>
Archived-At: <http://mailarchive.ietf.org/arch/msg/anima-bootstrap/n1-20ebpozvWpGo2j9w8TVLoCtc>
Cc: "anima-bootstrap@ietf.org" <anima-bootstrap@ietf.org>
Subject: Re: [Anima-bootstrap] Can the proxy add information during bootstrap?
X-BeenThere: anima-bootstrap@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Mailing list for the bootstrap design team of the ANIMA WG <anima-bootstrap.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/anima-bootstrap>, <mailto:anima-bootstrap-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/anima-bootstrap/>
List-Post: <mailto:anima-bootstrap@ietf.org>
List-Help: <mailto:anima-bootstrap-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/anima-bootstrap>, <mailto:anima-bootstrap-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 13 Apr 2016 12:53:11 -0000

Brian E Carpenter <brian.e.carpenter@gmail.com> wrote:
    >> I think it's a MITM attack for the proxy to add any information to the
    >> secure part.  Any information not under the security enclosure may be
    >> untrustworthy.

    > If there's a need to discover topology, which I understood Michael B
    > was after, couldn't that be done after enrolment, with no security
    > risk?

yes: exactly.  In fact, after enrollment, the resulting ACP that the new node
might form might have nothing to do with the topology used for enrollment.

I see no reason for the registrar to care about enrollment topology.

Consider two 14U BFRs in adjacent cabinets that use BTLE to enroll, establish
an ACP between them, and then configure the correct lambdas to light up the
100Gb/s links between them.
A new ACP link then comes up across that link (maybe using macsec..)

--
Michael Richardson <mcr+IETF@sandelman.ca>, Sandelman Software Works
 -= IPv6 IoT consulting =-