Re: Questions regarding the security mechanisms//RE: CRH and RH0

[John Scudder <[e-mail]>]

On May 22, 2020, at 1:02 PM, Nick Hilliard <[e-mail]> wrote:
> 
> Xiejingrong (Jingrong) wrote on 22/05/2020 17:16:
>> Hi John,
>> I have read the analysis you provided in previous message.
>> The "very helpful" is to the layered security mode: https://urldefense.com/v3/__https://en.wikipedia.org/wiki/Layered_security__;!!NEt6yMaO-gk!Tw9lbMxww481JNNLZlsb30EWBwhxUeOMmaFkiRKCTP1kWW7IWmKQhR2Zx-S1Gw$
>> To the RH security problem we are discussing:
>> (1) the border ACLs may fail to deploy. For example, there may be 1 border router (among 1000) is not configured correctly.
>> (2) a border router may be compromised (RFC8279 "If a BFIR is compromised"), the ACLs on the border router may be modified.
> 
> a useful second line on defence would be to recommend that all
> crh-capable nodes to drop packets containing CRHs if either the SID is
> unknown or if it comes from a source IP address outside the CRH domain.
> The perimeter of the domain will presumably already use regular iACLs to
> protect the internal infrastructure from spoofing attacks.  If your
> iACLs fail, you have bigger problems.
> 
> Good point though - something like this should go into the security
> considerations section.

Makes sense to me. (And is logically distinct from the 8754 case, in a good way.)

—John