Re: [karp] secdir review of draft-ietf-karp-ops-model-07

[Brian Weis <[e-mail]>]

On Aug 14, 2013, at 8:18 AM, Sam Hartman <[e-mail]> wrote:

>>>>>> "Radia" == Radia Perlman <[e-mail]> writes:
> 
>    Radia>    I think the document would be much improved with an
>    Radia> introduction about what is different for "routing protocol
>    Radia> security" rather than, say, an endnode authenticating to an
>    Radia> access point, or nodes forming a peer relationship in an
>    Radia> overlay network.  So, for instance, "normal security issues"
>    Radia> (i.e., outside the scope of KARP) might assume the network is
>    Radia> up, so that it's possible to get CRLs, or be available to be
>    Radia> managed, whereas perhaps KARP is targetting cases which
>    Radia> depend on less infrastructure.  It would be nice if this
>    Radia> document were to have an introduction that talks about things
>    Radia> like that.
> 
> I think that one of the previous KARP documents  (the overview or design
> guide) includes  a good review of that material.  I know I've seen a
> good write up of this in the KARP context before.
> KARP folks can you help jog my memory so I can add a reference?

This is a valuable point. But I can't find that good write-up in an RFC or I-D. Actually, Section 4.4 (The role of Central Servers) of this document has the best description conveying the point that minimal infrastructure is desirable. 

The best I find is RFC 6862, Section 1.1 Terminology, under Identity Authentication: "Certificates can be used in ways that require no additional supporting systems external to the routers themselves." That does not fully convey the thought that but could be referenced.

Brian