Re: [ippm] Secdir early review of draft-ietf-ippm-ioam-direct-export-07

[Tal Mizrahi <[e-mail]>]

Dear Stephen,

Many thanks for the comments.

Regarding issue (1), the following text update is proposed:

OLD:
   Forcing DEX, either in synthetic packets or in transit packets may
   overload the receiving entity (or entities).  Since this mechanism
   affects multiple devices along the network path, it potentially
   amplifies the effect on the network bandwidth and on the receiving
   entity's load.
NEW:
   Forcing DEX, either in synthetic packets or in transit packets may
   overload the IOAM nodes and/or the receiving entity (or entities).
   Since this mechanism affects multiple devices along the network
   path, it potentially amplifies the effect on the network bandwidth,
   on the storage of the devices that collect the data, and on the
   receiving entity's load.


Regarding issue (2), we have added a new paragraph to version 08 of
the draft that addresses this issue.

   An attacker may keep track of the information sent in DEX headers as
   a means of reconnaissance.  This form of recon can be mitigated to
   some extent by careful allocation of the Flow ID and Sequence Number
   space, in a way that does not compromise privacy aspects such as
   customer identities.


Please let us know if you have further comments.

Thanks,
Tal.


On Thu, May 19, 2022 at 7:51 PM Stephen Farrell
<[e-mail]> wrote:
>
>
> Hiya,
>
> On 19/05/2022 17:45, Haoyu Song wrote:
> > Hi Stephen,
> >
> > Thanks for the review. Both concerns are valid and the potential DOS
> > attack threat and mitigation are briefly discussed in the security
> > considerations section. The privacy consideration is the same as in
> > draft-ietf-ippm-ioam-data, also similar to that for IPFIX and
> > Netflow. I think here we need to emphasize that all the data
> > collected are network operation related without user private
> > information. The technology is also supposed to be applied in a
> > single managed domain. We can add some discussion on the privacy
> > issue in the next revision.
>
> Good stuff. Just to note though that "without user
> private information" can be very hard to ensure, e.g.
> any combination of IP address and time can be enough
> to cause problems sometimes, e.g. if a collection of
> such records leaks later.
>
> Cheers,
> S.
>
> >
> > Best regards, Haoyu
> >
> > -----Original Message----- From: Stephen Farrell via Datatracker
> > <[e-mail]> Sent: Thursday, May 19, 2022 8:37 AM To:
> > [e-mail] Cc: [e-mail];
> > [e-mail] Subject: Secdir early review of
> > draft-ietf-ippm-ioam-direct-export-07
> >
> > Reviewer: Stephen Farrell Review result: Has Issues
> >
> > First, apologies for the dramatically late review. I hope this is
> > still useful.
> >
> > I think there are two issues worth considering:
> >
> > 1. The DEX scheme seems to create a potential for DoS based on
> > storage whereas I think prevously only DoS vectors related to traffic
> > were documented in the IAOM drafts. That's based on a quick scan
> > though so I may have missed it being considered.
> >
> > 2. I see no mention at all of privacy in this draft nor in
> > draft-ietf-ippm-ioam-data - I don't understand why that's ok given
> > that privacy leaks from the kind of metadata collected here can be
> > subtle? Or maybe that's in some other draft?
> >
> >
> >