Re: [ippm] Secdir last call review of draft-ietf-ippm-stamp-on-lag-05

[Tianran Zhou <[e-mail]>]

Hi Nancy,

Thanks very much for this expert review from the security point of view.
I am not sure if the confidentiality and privacy are really issues in this proposal.
Because the "Sender Micro-session ID" in the message is not really the sender hardware id. It's assigned by the controller.
There is mapping between "Sender Micro-session ID" and "Sender member link identifiers".
So you can see there is text in Section 3.2:
"The mapping between a micro STAMP session and the Sender/Reflector member
   link identifiers can be configured by augmenting the STAMP YANG
   [I-D.ietf-ippm-stamp-yang]." 
And the configuration channel is secured by TLS.

Best,
Tianran

-----Original Message-----
From: Nancy Cam-Winget via Datatracker [mailto:[e-mail]] 
Sent: Tuesday, December 12, 2023 7:14 AM
To: [e-mail]
Cc: [e-mail]; [e-mail]; [e-mail]
Subject: Secdir last call review of draft-ietf-ippm-stamp-on-lag-05

Reviewer: Nancy Cam-Winget
Review result: Has Issues

I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written primarily for the benefit of the security area directors.  Document editors and WG chairs should treat these comments just like any other last call comments.


This document defines an extension to the Simple Two-Way Active Measurement Protocol (STAMP) to facilitate performance measurement on every member link of a tag.  As such, the proposed extension is to define a Micro-session identifier and a Session-Reflector member link identifier.

Issue:
As this draft is now exposing identifiers to the actual nodes in the link, there must be inclusions that describe the potential exposure of these nodes given their identifiers are now explicitly communicated.
RFC 8762 only addresses the integrity not the confidentiality of the information disclosed which with the session identifier now needs to be considered.  In addition, privacy considerations describing the potential consequences of this disclosure can lead to.