[L2tpext] draft-ietf-l2tpext-l2tp-atm-02.txt

Some IESG comments on the security considerations section.

reviewer 1
> note:
>         this has the same problem as PPP over AAL2
>         the security section makes an unreasonable assumption on
>         ATM security

Reviewer 2:
> >9. Security Considerations
> >
> >   ATM networks, being virtual circuit based, are generally less
> >   vulnerable to security attacks than IP based networks.  The
> >   probability of a security breach caused by misrouted ATM cells is
> >   considered to be negligible.
> 
> As in the case of PPP over AAL5, this is making an assumption about
> who and how the ATM network is being operated and as such is
> inappropriate in a standards document. I would recommend striking this
> paragraph completely.
> 
> >   Currently there is no standard specification for ATM security.
> >   However, the ATM Forum is working on an ATM Security Framework
> >   document.  In light of this work, the issue of security will be re-
> >   examined at a later date to see if L2TP over ATM specific protection
> >   mechanisms are still required.  In the interim, basic security issues
> >   are discussed in the base L2TP specification [RFC2661].
> 
> I believe this paragraph is fine.

Actually, maybe the above isn't really fine afterall. Note that
draft-ietf-pppext-ppp-over-aal2-03.txt was recently updated with the
following text:

> System security may also be compromised by the attacks of the ATM
> transport network itself. The ATM Forum has published a security
> framework [11] and a security specification [12] that define
> procedures to guard against common threats to an ATM transport
> network.

So, is it really the case to say that ATM has no security?

Thomas

_______________________________________________
L2tpext mailing list
L2tpext@ietf.org
https://www1.ietf.org/mailman/listinfo/l2tpext