Re: [mpls] FW: I-D Action: draft-farrelll-mpls-opportunistic-encrypt-00.txt

[Mark Tinka <[e-mail]>]

On Thursday, January 09, 2014 01:51:03 PM Adrian Farrel 
wrote:

> Hi MPLS working group,
> 
> Stephen and I have been looking at MPLS data plane
> security and wondering whether anything could be done to
> help protect against various types of bulk surveillance
> achieved by tapping entire links without requiring full
> and management-heavy establishment of security
> associations.
> 
> This I-D is very rough! it is a first attempt to show
> what might be achieved. We are confident that there are
> problems with what we have suggested both from a
> security and an MPLS perspective. Your thoughts and
> comments are encouraged.

Thanks for this draft, Farrel twins.

As an operator, my rather high level concerns are:

	- What impact does this have on linear data plane
	  throughput?

	- What impact does this have on data plane
	  operational complexity?

	- What impact does this have on the control plane.

	- How efficient is key management on a global level,
	  and what is the practical impact to day-to-day
	  operations, for situations where MPLS paths cross
	  distinct routing domains?

	- What kind of backward compatibility is there for
	  domains that do not participate, or for nodes
	  within the same domain that do not participate, as
	  this has an impact on overall domain capability
	  (i.e., cost).

Cheers,

Mark.