Re: [Last-Call] Secdir last call review of draft-ietf-bier-oam-requirements-12

[Greg Mirsky <[e-mail]>]

Hi Barry,
thank you for your comments and suggestions. I agree that even though this
document lists requirements for BIER OAM, the Security Consideration
section should be more useful to a reader. Below is the proposed update:
OLD TEXT:
   This document lists the OAM requirement for a BIER-enabled domain and
   does not raise any security concerns or issues in addition to ones
   common to networking.
NEW TEXT:
   This document lists the OAM requirement for a BIER-enabled domain and
   thus inherits security considerations discussed in [RFC8279] and
   [RFC8296].  Another general security aspect results from using active
   OAM protocols, according to the [RFC7799], in a multicast network.
   Active OAM protocols inject specially constructed test packets, and
   some active OAM protocols are based on the echo request/reply
   principle.  In the multicast network, test packets are replicated as
   data packets, thus creating a possible amplification effect of
   multiple echo responses being transmitted to the sender of the echo
   request.  Thus, an implementation of BIER OAM MUST protect the
   control plane from spoofed replies.  Also, an implementation of BIER
   OAM MUST provide control of the number of BIER OAM messages sent to
   the control plane.

What are your thoughts about the new text? I greatly appreciate your
comments, suggestions, and questions.

Regards,
Greg

On Wed, Aug 9, 2023 at 12:09 PM Barry Leiba via Datatracker <
[e-mail]> wrote:

> Reviewer: Barry Leiba
> Review result: Has Issues
>
> The only comment I have from a security standpoint is that the Security
> Considerations seem basically absent, saying no more than "Nothing to see
> here."  That's common and easy to say, but I expected some explanation of
> how
> the requirements specified in the document are needed to ensure a robust
> and
> secure BIER system.  I wouldn't expect pages of text, but I'm surprised to
> see
> nothing at all.  Is it really the case that an OAM system for BIER would do
> nothing to enhance security, nothing to alert us to BIER-specific attacks?
>
>
>