Re: [Lsr] [Tsv-art] Tsvart last call review of draft-ietf-lsr-isis-rfc7810bis-03

[Spencer Dawkins at IETF <[e-mail]>]

Hi, Les,

On Wed, Dec 5, 2018 at 11:08 PM Les Ginsberg (ginsberg) <[e-mail]>
wrote:

> Spencer –
>
>
>
> The choice of whether to use cryptographic authentication or not is a
> deployment decision. It is not the place of this RFC (or any other IGP RFC)
> to require that a customer use authentication of any kind. However, in
> Security sections we do mention that the use of cryptographic
> authentication may well be prudent to avoid risks associated with the
> advertisements which the document is defining.
>
>
>
> Make sense?
>

Sure, and I'm not asking for an
https://tools.ietf.org/html/rfc6919#section-1 "MUST (BUT WE KNOW YOU
WON'T)" - and this is the second draft on this telechat where I've used
that link in my balloting discussion, so You Are Not Alone!

Thanks for helping me understand.

Spencer

I agree there is an editorial issue.
>
>
>
> “mitigation the risk” should be “mitigation of the risk”
>
>
>
> I will address that.
>
>
>
>    Les
>
>
>
>
>
> *From:* Spencer Dawkins at IETF <[e-mail]>
> *Sent:* Wednesday, December 05, 2018 6:41 PM
> *To:* Les Ginsberg (ginsberg) <[e-mail]>
> *Cc:* [e-mail]; [e-mail]; [e-mail]; IETF list <
> [e-mail]>; [e-mail]
> *Subject:* Re: [Tsv-art] Tsvart last call review of
> draft-ietf-lsr-isis-rfc7810bis-03
>
>
>
> Hi, Les,
>
>
>
> On Wed, Dec 5, 2018 at 6:52 PM Les Ginsberg (ginsberg) <[e-mail]>
> wrote:
>
> Yoshi -
>
> Thanx for taking the time to review.
>
> I can appreciate that this may the first time you have looked at RFC7810 -
> let alone the bis draft. As a result you have commented on content which is
> common to the bis draft and the RFC it is modifying (RFC 7810).
>
> While your questions in isolation may be interesting, I believe they are
> out of scope for the review of the bis draft. What the bis draft is doing
> is addressing two modest errata - details of which can be found in
> https://tools.ietf.org/html/draft-ietf-lsr-isis-rfc7810bis-03#appendix-A
> Comments on content not related to those changes is out of scope.
>
> If you have an interest in this topic and want to comment on the substance
> of RFC 7810 and its companion document for OSPF RFC 7471, I encourage you
> to do so. Note that all of your comments (save the one on Security) are
> also applicable to RFC 7471 - so any agreed upon modification would need to
> be made to both documents. But I do not want to even start discussing such
> changes in the context of reviewing the bis draft changes. I hope you can
> understand why.
>
> As regards your Security comment, I am not sure I understand what you are
> suggesting. As IGP info is flooded hop-by-hop, man-in-the-middle attacks
> have to be able to insert themselves on an IGP enabled link. Use of
> cryptographic authentication prevents untrusted sources from being accepted
> - which is the point being made.
>
>
>
> I'm just making sure I understand this last point.
>
>
>
> The text Yoshi flagged,
>
>
>
>     "The use of Link State PDU cryptographic authentication allows
> mitigation
>
>     the risk of man-in-
>
>      the-middle attack."
>
>
>
> is saying "smart people would use Link State PDU cryptographic
> authentication unless they have a reason to be OK with man-in-the-middle
> attacks", but there's no normative requirement to use this mitigation
> technique.
>
>
>
> I think that's what Yoshi was asking about.
>
>
>
> Is that the intent?
>
>
>
> Thanks,
>
>
>
> Spencer
>
>
>
> p.s. Is there a missing word after "mitigation"?
>