[lisp] FW: I-D Action: draft-ietf-lisp-sec-18.txt

["Fabio Maino (fmaino)" <[e-mail]>]

Hi Ben, 
Now that the LISP-SEC LC has closed, I'm popping this message back to the top of your inbox. 

We discussed the rationale for most of these changes with you in Prague, below is a brief list that may help recalling that conversation. 

Thanks,
Fabio

 

On 6/2/19, 7:34 AM, "lisp on behalf of Fabio Maino (fmaino)" <[e-mail] on behalf of [e-mail]> wrote:

    This rev of the lisp-sec draft includes the following main changes: 
    1. a mechanism that allows an ITR to secure downgrade to non LISP-SEC Map-Requests, if it wishes to do so. This is done as discussed in the list and in Prague with Ben
    2. the use of  a per-message key (derived from the pre-shared secret) to protect transport of One-Time-Key from ITR->Map-Resolver and from Map-Server->ETR. This is consistent with the changes that are being introduced in 6833bis, and with what discussed with Ben in Prague
    3. Comments posted by Med on 1/28 are addressed. You can check my notes on the attached word document that describe how each comment has been disposed
    
    
    Attached diff will guide through the changes, but the main protocol changes are:
    - Introduction of ETR-Can’t-Sign E bit in the ECM Authentication Data. This is used as described in section 5.7 to allow secure downgrade to non LISP-SEC (if the ITR choose to do so)
    - Splitting the “OTK Encryption ID” 16-bit field in the ECM Authentication Data into two 8-bit fields (this is consistent with what done in 6833bis for various LISP protocol messages):
    	- Key ID, that identifies the pre-shared secret
    	- OTK Wrapping ID, that identifies the KDF used to derive the per-message OTK encryption key AND the OTK Wrapping algorithm
    - Description of how to derive the per-message OTK encryption key from pre-shared secret (this is coherent with what we did in 6833bis to derive per-message Map-register authentication key). Terminology will be consistent with the next rev of 6833bis
    
    
    Thanks especially  to Ben for the suggested improvements, and to Med for the very detailed review. 
    
    Fabio
    
    
    On 6/2/19, 7:15 AM, "lisp on behalf of [e-mail]" <[e-mail] on behalf of [e-mail]> wrote:
    
        
        A New Internet-Draft is available from the on-line Internet-Drafts directories.
        This draft is a work item of the Locator/ID Separation Protocol WG of the IETF.
        
                Title           : LISP-Security (LISP-SEC)
                Authors         : Fabio Maino
                                  Vina Ermagan
                                  Albert Cabellos
                                  Damien Saucez
        	Filename        : draft-ietf-lisp-sec-18.txt
        	Pages           : 27
        	Date            : 2019-06-02
        
        Abstract:
           This memo specifies LISP-SEC, a set of security mechanisms that
           provides origin authentication, integrity and anti-replay protection
           to LISP's EID-to-RLOC mapping data conveyed via mapping lookup
           process.  LISP-SEC also enables verification of authorization on EID-
           prefix claims in Map-Reply messages.
        
        
        
        The IETF datatracker status page for this draft is:
        https://datatracker.ietf.org/doc/draft-ietf-lisp-sec/
        
        There are also htmlized versions available at:
        https://tools.ietf.org/html/draft-ietf-lisp-sec-18
        https://datatracker.ietf.org/doc/html/draft-ietf-lisp-sec-18
        
        A diff from the previous version is available at:
        https://www.ietf.org/rfcdiff?url2=draft-ietf-lisp-sec-18
        
        
        Please note that it may take a couple of minutes from the time of submission
        until the htmlized version and diff are available at tools.ietf.org.
        
        Internet-Drafts are also available by anonymous FTP at:
        ftp://ftp.ietf.org/internet-drafts/
        
        _______________________________________________
        lisp mailing list
        [e-mail]
        https://www.ietf.org/mailman/listinfo/lisp