Re: [mpls] Poll to see if we have consensus to adopt draft-farrelll-mpls-opportunistic-encrypt as an MPLS wg document

[Eric C Rosen <[e-mail]>]

I don't think we can tell yet whether this draft really provides a good 
basis for future work.  As such, it seems premature for the WG to adopt 
it.  I think there are several major issues that should be confronted first.

The draft seems heavily focused on P2P LSPs.  That wouldn't be a problem 
if it were about pseudowire security.  But it's a big problem if the 
draft is supposed to apply to MPLS generally.  There's a lot of MPLS out 
there that uses LDP or BGP (or even IGP) to bind labels to address 
prefixes, thereby creating MP2P LSPs.  If that's not going to be 
handled, I don't see how the draft can claim to be providing an MPLS 
security scheme.

Of course, it could be that MPLS is not the right layer for security; 
I'm not sure that any one security scheme is going to be suitable for 
all uses of MPLS.

The idea of applying security on a per-LSP basis doesn't really seem 
right either.  In VPN, with per-address-prefix labeling, there could be 
hundreds of thousands of LSPs.  I can see someone claiming that security 
needs to be provided on a VRF-to-VRF basis rather than on a PE-to-PE 
basis, but having security on a per-address-prefix basis seems like way 
too much granularity.  I can't really tell from the draft how it would 
be intended to apply to VPN, so I don't really know what the authors 
have in mind for securing VPNs.

The draft would really benefit from having some worked out examples of 
how MPLS security would work in various VPN deployment scenarios, 
including the following (and combinations thereof):

- Multi-AS VPN with "option b" interconnect

- Multi-AS VPN with "option c" interconnect

- VPN with per-address-prefix labels assigned by BGP

- VPN with per-VRF labels assigned by BGP

The multi-AS VPN cases are particularly interesting, because they make 
use (in different ways) of nested LSPs.  Someone who wants privacy for 
his VPN traffic will want security applied to the inner LSP (the one 
that goes from the ingress PE to the egress PE), not just to the outer 
LSPs (the ones that go from ingress PE to ASBR, etc.) but it's not clear 
whether any of the techniques in the draft can be used that way.

There are also cases where labels get assigned to anycast addresses.  I 
wonder how the security scheme would be applied to those cases.

There are other issues in the draft as well, such as whether 
MPLS-specific hop-by-hop security is really useful when one can use 
simpler layer 2 security schemes instead.  But right now my main concern 
is that the end-to-end scheme will turn out to have very limited 
applicability.

Working out some realistic examples would help us understand whether 
this is really the right way to proceed.