Re: [Idr] Possible to set up priority for Tunnels established by draft-ietf-idr-tunnel-encaps-09 ?

[Linda Dunbar <[e-mail]>]

Eric,

Security area has a Working Group draft on the data model of exchanging IPsec Keys: https://datatracker.ietf.org/doc/draft-ietf-i2nsf-sdn-ipsec-flow-protection/

It was a very lengthy debate on exposing the key via Netconf. Eventually, they (IPsecme group) agreed to ADOPT BUT requiring the authors to document all the associated security risks in the draft. So that people/companies who are willing to take the risks documented in the draft can use them. Maybe we can get pass security expert review afterwards.

We are hoping for a BGP message with a specific SAFI as did in RFC 5512 to carry the information instead of mixing with the BGP UPDATE message, so that receiving CPE doesn’t have to do extra processing, and the msg can be sent via any paths.

Linda

From: Eric C Rosen [mailto:[e-mail]]
Sent: Tuesday, July 10, 2018 10:13 AM
To: Linda Dunbar <[e-mail]>; Jeff Tantsura <[e-mail]>; [e-mail]; [e-mail]
Subject: Re: [Idr] Possible to set up priority for Tunnels established by draft-ietf-idr-tunnel-encaps-09 ?

On 7/9/2018 4:28 PM, Linda Dunbar wrote:

We would like to use RR as controller to distribute more detailed tunnel information, such as IPsec configuration & keys because in managed large scale Overlay deployment (SD-WAN), it doesn’t scale to allow all CPEs to negotiate IPsec keys.

When first working on RFC 5566, I proposed a number of sub-TLVs that could be used to convey information about how to set up the IPsec Security Associations.  None of thes survived review by the security experts.  Setting up the Security Associations is the job of IKEv2.  If you want to replace IKEv2 with BGP, you'll need a thorough security analysis of your proposed mechanism.

One might think it is okay to have BGP UPDATEs carry secret keys , as long as the UPDATEs only travel on sessions that are protected by IPsec.  I wouldn't necessarily assume that, as BGP UPDATEs have been known to leak (intentionally or unintentionally) beyond their intended scope.