Re: [netmod] Secdir last call review of draft-ietf-netmod-factory-default-14

"Rob Wilton (rwilton)" <rwilton@cisco.com> Tue, 10 March 2020 13:38 UTC

Return-Path: <rwilton@cisco.com>
X-Original-To: netmod@ietfa.amsl.com
Delivered-To: netmod@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6FFEE3A12DA for <netmod@ietfa.amsl.com>; Tue, 10 Mar 2020 06:38:53 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -9.598
X-Spam-Level:
X-Spam-Status: No, score=-9.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=GMhqsK7K; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=OTy/KheC
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id luLsoECfIme2 for <netmod@ietfa.amsl.com>; Tue, 10 Mar 2020 06:38:51 -0700 (PDT)
Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0868B3A11B3 for <netmod@ietf.org>; Tue, 10 Mar 2020 06:38:50 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=5162; q=dns/txt; s=iport; t=1583847530; x=1585057130; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=e0t81bm40uxBaSqXomXKnnYLYgo1hGVCH9vTT8kZZi0=; b=GMhqsK7KBXKNOCiLO8RJ+dVAi0Er4XddHwVWRKVx4yTqitlZVWY1faEc CeMdTeAAFF/k4yanKD+LDNR3FWOfQao9mgi+P1hTEk2GEb7nSLp+hTRjU RHYK4K1HrC1+e6jtPYOOxAKHXY+MidGM9wG10a2f1xxnoWojlmMozX4XP E=;
IronPort-PHdr: =?us-ascii?q?9a23=3AUi+wHRcfrHNh09argZJs+aeUlGMj4e+mNxMJ6p?= =?us-ascii?q?chl7NFe7ii+JKnJkHE+PFxlwGRD57D5adCjOzb++D7VGoM7IzJkUhKcYcEFn?= =?us-ascii?q?pnwd4TgxRmBceEDUPhK/u/dTM7GNhFUndu/mqwNg5eH8OtL1A=3D?=
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0CCAAALmGde/5tdJa1iAxkBAQEBAQE?= =?us-ascii?q?BAQEBAQEBAQEBAREBAQEBAQEBAQEBAYF7gVRQBWxYIAQLKgqEC4NFA4pvgl+?= =?us-ascii?q?YFYFCgRADVAkBAQEMAQEYCwoCBAEBg35FAheBbyQ4EwIDAQELAQEFAQEBAgE?= =?us-ascii?q?FBG2FVgyFYwEBAQEDAQEQEREMAQEsCwELAgICAQYCDgIBBAEBAQICIwMCAgI?= =?us-ascii?q?ZDAsUAQgIAQEEAQ0FCBqDBYJKAy4BDo0okGcCgTmIYnWBMoJ/AQEFhQ8Yggw?= =?us-ascii?q?DBgWBCSqKaYFDGoFBP4FYgk0+gmQBAQKBSgMYFQomgkoygiyQbJABjiKBHwq?= =?us-ascii?q?CPIdUimKEUYJKiCSQTI55gU6HL5JVAgQCBAUCDgEBBYFpIoFYcBU7gmxQGA2?= =?us-ascii?q?OHYNzM4RhhUF0AgEKgRyLFYEyAYEPAQE?=
X-IronPort-AV: E=Sophos;i="5.70,537,1574121600"; d="scan'208";a="730916840"
Received: from rcdn-core-4.cisco.com ([173.37.93.155]) by rcdn-iport-7.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 10 Mar 2020 13:38:31 +0000
Received: from XCH-RCD-001.cisco.com (xch-rcd-001.cisco.com [173.37.102.11]) by rcdn-core-4.cisco.com (8.15.2/8.15.2) with ESMTPS id 02ADcVbp006288 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Tue, 10 Mar 2020 13:38:31 GMT
Received: from xhs-rtp-003.cisco.com (64.101.210.230) by XCH-RCD-001.cisco.com (173.37.102.11) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 10 Mar 2020 08:38:31 -0500
Received: from xhs-aln-003.cisco.com (173.37.135.120) by xhs-rtp-003.cisco.com (64.101.210.230) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 10 Mar 2020 09:38:23 -0400
Received: from NAM11-BN8-obe.outbound.protection.outlook.com (173.37.151.57) by xhs-aln-003.cisco.com (173.37.135.120) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Tue, 10 Mar 2020 08:38:23 -0500
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; =?utf-8?q?b=3DHOhnSJbtzy3JJKytFEU4FGUGYUvQjr2r+PCxUJh4YEj2j0r/Z+cso9MM2EYZg?= =?utf-8?q?+nPGWgMziA1IMpr0XQ4YijFoA2X2JVwVFkoMQrFRL+Wxenpi/OFHz7mvCca579yhz?= =?utf-8?q?L7Dnfj6dZuP2ZOhnzSj5/KLH39cJGqcrqlAx8goThMUdXCy5X+SPrVCc8uAf8YWz+?= =?utf-8?q?cNfx7Z0pXWpBdYW6iMsJFqyPyxrgH8PAs/hyyjUyRnMAl6RDxzM55c75HTp7MGUjA?= =?utf-8?q?LYIIVVJc75xhOvZxupvGoedJULq9E/sOrn5U+7Mo32rjCkZA9QKL4ma9FLef3vKZk?= =?utf-8?q?T89CxDG4EN4gH2it4hdPA=3D=3D?=
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; =?utf-8?q?h=3DFrom=3ADate=3ASubject=3AMessage-ID=3ACont?= =?utf-8?q?ent-Type=3AMIME-Version=3AX-MS-Exchange-SenderADCheck=3B?= =?utf-8?q?bh=3De0t81bm40uxBaSqXomXKnnYLYgo1hGVCH9vTT8kZZi0=3D=3B_b=3DNvCCJP?= =?utf-8?q?xJ4eiHsOoGyc3LyMq+tCBwYq0nkQE+E3QYCZviNfqnNPjbCQhuR7dqgaLjpsKKgPK?= =?utf-8?q?vSSUrykBFqR4L+Faxh27YZR5GyiVEuEtUtWSJ7Rgwn+cahSpmYKULbfeVZPLLRcV0?= =?utf-8?q?ELqoAjytdfnmCmEF7+961SLF/k2gcjTi9/+tsGUGL8FFYNng3VCYiygX019dnbmU3?= =?utf-8?q?pU/+FFS/BVqKPZQCy2kmm3qj+q25OrtN/Wa3BQ9CLAwmpWPySSwWqn9Kegek7gUqk?= =?utf-8?q?e1JHwdwFLXMflu08ZAJhRZ0qtozH26b+GBuwty3kO2/apUxZyoaKROILYQOCdI8Lb?= =?utf-8?q?jjc79bYvexw=3D=3D?=
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cisco.com; dmarc=pass action=none header.from=cisco.com; dkim=pass header.d=cisco.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; =?utf-8?q?h=3DFrom=3ADate=3ASubject=3AM?= =?utf-8?q?essage-ID=3AContent-Type=3AMIME-Version=3AX-MS-Exchange-SenderADC?= =?utf-8?q?heck=3B_bh=3De0t81bm40uxBaSqXomXKnnYLYgo1hGVCH9vTT8kZZi0=3D=3B_b?= =?utf-8?q?=3DOTy/KheCOVnqAZ7ZznlBM1B7OvTyvIHIg52KSXSJgwMrC/odPq0tKQf2DjMV8I?= =?utf-8?q?DW//jIHEriWBXxNvyIxZHE86bHP+5vbVN4Ylei1G7YLu3WgIymtEFOrQWMeYoGrLs?= =?utf-8?q?tFZ4JE/YOh1DCHM/yX1mrGCsCJeNpln2Vdnvx7c+3Weg=3D?=
Received: from BY5PR11MB4355.namprd11.prod.outlook.com (2603:10b6:a03:1c3::13) by BY5PR11MB4260.namprd11.prod.outlook.com (2603:10b6:a03:1ba::30) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2793.17; Tue, 10 Mar 2020 13:38:22 +0000
Received: from BY5PR11MB4355.namprd11.prod.outlook.com ([fe80::5434:7127:ff4b:e6f4]) by BY5PR11MB4355.namprd11.prod.outlook.com ([fe80::5434:7127:ff4b:e6f4%4]) with mapi id 15.20.2793.013; Tue, 10 Mar 2020 13:38:22 +0000
From: "Rob Wilton (rwilton)" <rwilton@cisco.com>
To: Juergen Schoenwaelder <j.schoenwaelder@jacobs-university.de>, Qin Wu <bill.wu@huawei.com>
CC: =?utf-8?B?QmFsw6F6cyBMZW5neWVs?= <balazs.lengyel=40ericsson.com@dmarc.ietf.org>, "'netmod@ietf.org'" <netmod@ietf.org>, Warren Kumari <warren@kumari.net>
Thread-Topic: [netmod] Secdir last call review of draft-ietf-netmod-factory-default-14
Thread-Index: AdX21MP/2zkYIfFbQPmpql59+9P4kQAAV3uAAAKHIwA=
Date: Tue, 10 Mar 2020 13:38:22 +0000
Message-ID: =?utf-8?q?=3CBY5PR11MB43553E7CA237521A7C44F9E1B5FF0=40BY5PR11MB4?= =?utf-8?q?355=2Enamprd11=2Eprod=2Eoutlook=2Ecom=3E?=
References: <B8F9A780D330094D99AF023C5877DABAAD548070@dggeml511-mbs.china.huawei.com> <20200310121923.hgbo3azelxud4xgt@anna.jacobs.jacobs-university.de>
In-Reply-To: <20200310121923.hgbo3azelxud4xgt@anna.jacobs.jacobs-university.de>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: spf=none (sender IP is ) smtp.mailfrom=rwilton@cisco.com;
x-originating-ip: [173.38.220.34]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: 9061d977-941e-46c4-432a-08d7c4f84d6e
x-ms-traffictypediagnostic: BY5PR11MB4260:
x-microsoft-antispam-prvs: =?utf-8?q?=3CBY5PR11MB426016E7BAE5CD43012B3D16B5F?= =?utf-8?q?F0=40BY5PR11MB4260=2Enamprd11=2Eprod=2Eoutlook=2Ecom=3E?=
x-ms-oob-tlc-oobclassifiers: OLM:10000;
x-forefront-prvs: 033857D0BD
x-forefront-antispam-report: SFV:NSPM; =?utf-8?q?SFS=3A=2810009020=29=284636?= =?utf-8?b?MDA5KSgzOTYwMDMpKDM2NjAwNCkoMTM2MDAzKSgzNDYwMDIpKDM3NjAwMikoMzk4?= =?utf-8?b?NjA0MDAwMDIpKDE5OTAwNCkoMTg5MDAzKSgxODYwMDMpKDgxMTY2MDA2KSg4?= =?utf-8?q?676002=29=2854906003=29=2881156014=29=28110136005=29=288936002=29?= =?utf-8?b?KDMxNjAwMikoNjQ3NTYwMDgpKDc2OTYwMDUpKDY2NDc2MDA3KSgyOTA2MDAyKSgz?= =?utf-8?q?3656002=29=2866446008=29=2866946007=29=2866556008=29=2876116006?= =?utf-8?b?KSg2NjU3NDAxMikoNDc4NjAwMDAxKSg1MjUzNjAxNCkoODYzNjIwMDEpKDI2?= =?utf-8?q?005=29=2871200400001=29=284326008=29=2853546011=29=286506007=29?= =?utf-8?q?=289686003=29=2855016002=29=285660300002=29=28966005=29=3B?= DIR:OUT; SFP:1101; SCL:1; SRVR:BY5PR11MB4260; H:BY5PR11MB4355.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1;
received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: =?utf-8?q?+YmwDXgFpJZU5X2G9PhRJ6uGK98xQjA?= =?utf-8?q?ut74qS1ID7E45TXjJT2dACbZakodngTDONpb8ATSbJnQRQy7XpFgQhPpYeWUlBBvq?= =?utf-8?q?A8zA11Z2a5kkRI2WP3ijJr616FkEP+g7XlBkhEm/CQXQnzR4dsFIYwMei6RWAb1xk?= =?utf-8?q?iAvRE0An98j5wnol/tHNG+AUhbZZEUiCyyocKIwwwZrxkFUjWqECw1/cy2qACG24g?= =?utf-8?q?fi0UI/7Ho5NC+j/AqKfh1sKbZQwk7l7Ekkt5QAGs0/K64O+uwCgF0OJqSIDnRE9Pn?= =?utf-8?q?6kQPLRkyPuu3qDT1e1nsuSohq4MhSl1GPJBO989W2yJLUFUozKRKctzoTk9sjviPy?= =?utf-8?q?P9Bx6411Yok6QKtFJ/6Zs9Rh9Bmu1NfOEns1qVO3TvWJ2yKc5sXaTNH9c9B5btXdd?= =?utf-8?q?PGVkcmcswhxltVwny9aVl+7iLIV5IIfVGNzh0OWSmpObM+HzhCC0q24oQf4MmTt65?= =?utf-8?q?PJwJQ9NTdvNkkwmyZmLo4Y5QLrVZ5O6/RByWsOMqceCNFdEQ=3D=3D?=
x-ms-exchange-antispam-messagedata: =?utf-8?q?55/3veq3LbRlaxjlXdqiC15XdSIlpK?= =?utf-8?q?vLVEiSp+nPl/a6NjB8ZZLw+E4qzsJeuOg9DW4syWXQZumgw4Kiqe0f33sJIbJgbiZ?= =?utf-8?q?H4KsuUpMqK29rN8JLfmwj3W+wn8cDwZZBMRBhdEngIu9X1HDvO26vIg=3D=3D?=
x-ms-exchange-transport-forked: True
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 9061d977-941e-46c4-432a-08d7c4f84d6e
X-MS-Exchange-CrossTenant-originalarrivaltime: 10 Mar 2020 13:38:22.4300 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: =?utf-8?q?f+V8c0oAsXWDK6W6CNBZ5?= =?utf-8?q?HgO5dTnNb1GPMxNc2OSmbL/90h+ZSPOzz/C4yu2Onfh15pewOVIxYEVlLVIXKRl5g?= =?utf-8?q?=3D=3D?=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY5PR11MB4260
X-OriginatorOrg: cisco.com
X-Outbound-SMTP-Client: 173.37.102.11, xch-rcd-001.cisco.com
X-Outbound-Node: rcdn-core-4.cisco.com
Archived-At: <https://mailarchive.ietf.org/arch/msg/netmod/sItCtzXzqNuwKjYOm5_xWINlrvI>
Subject: Re: [netmod] Secdir last call review of draft-ietf-netmod-factory-default-14
X-BeenThere: netmod@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: NETMOD WG list <netmod.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/netmod>, <mailto:netmod-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/netmod/>
List-Post: <mailto:netmod@ietf.org>
List-Help: <mailto:netmod-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/netmod>, <mailto:netmod-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 10 Mar 2020 13:38:54 -0000

I basically agree with Juergen.

I have also raised this with the security ADs to try and find a path to resolve this.

Thanks,
Rob


> -----Original Message-----
> From: netmod <netmod-bounces@ietf.org> On Behalf Of Juergen Schoenwaelder
> Sent: 10 March 2020 12:19
> To: Qin Wu <bill.wu@huawei.com>
> Cc: Balázs Lengyel <balazs.lengyel=40ericsson.com@dmarc.ietf.org>rg>;
> 'netmod@ietf.org' <netmod@ietf.org>
> Subject: Re: [netmod] Secdir last call review of draft-ietf-netmod-
> factory-default-14
> 
> Hi,
> 
> if secdir people believe RFC 6242 needs to be revised or updated, then
> this is a separate work item for the NETCONF working group to consider. I
> do not think that such an update should gate any data models currently in
> the pipeline. (I am not even sure such an update is strictly needed since
> if we go there, we constantly need udpates, but that is then a NETCONF
> discussion.)
> 
> /js
> 
> On Tue, Mar 10, 2020 at 12:13:51PM +0000, Qin Wu wrote:
> > Thanks Balazs for heads up. I think the security guideline we are
> currently following is one defined in the following link:
> > https://trac.ietf.org/trac/ops/wiki/yang-security-guidelines
> > If it is a issue, I believe it applies to all YANG related documents.
> >
> > -Qin
> > -----邮件原件-----
> > 发件人: netmod [mailto:netmod-bounces@ietf.org] 代表 Balázs Lengyel
> > 发送时间: 2020年3月10日 19:59
> > 收件人: 'netmod@ietf.org' <netmod@ietf.org>
> > 主题: [netmod] FW: Secdir last call review of
> > draft-ietf-netmod-factory-default-14
> >
> > As an author of netmod drafts I would like to see some general guidance
> on this issue. Can someone help please.
> > Balazs
> >
> > -----Original Message-----
> > From: Stephen Kent via Datatracker <noreply@ietf.org>
> > Sent: 2020. március 9., hétfő 20:15
> > To: secdir@ietf.org
> > Cc: netmod@ietf.org; draft-ietf-netmod-factory-default.all@ietf.org;
> > last-call@ietf.org
> > Subject: Secdir last call review of
> > draft-ietf-netmod-factory-default-14
> >
> > Reviewer: Stephen Kent
> > Review result: Has Issues
> >
> > SECDIR review of draft-ietf-netmod-factory-default-14
> >
> > Section 6, Security Considerations, calls for use of SSH (RFC 6242)
> > with NETCONF and HTTPS (RFC 8446) with RESTCONF. The TLS reference is
> > current, citing TLS v1.3. However, RFC 6242 is a document that
> > describes how to use SSH with NETCONF. That document, in turn, cites
> > RFC 4254, and that RFC cites RFC
> > 4253 for a description of SSH. 4253 is a very much out of date document;
> the integrity and key management algorithms in the original RFC have been
> updated 3 times (6668, 8268, and 8332). The encryption algorithms cited in
> 4253 are all outdated. This discussion of SSH security for use with
> NETCONF, based on the one citation, seems to be inconsistent with current
> IETF crypto guidelines.
> > This is a problem that the net management area should address before
> this document is approved.
> >
> > The discussion of how a factory-reset RPC may isolate a device, is good,
> as is the warning about not relying on this RPC to prevent recovery of
> security-sensitive data from NV storage.
> >
> >
> >
> > _______________________________________________
> > netmod mailing list
> > netmod@ietf.org
> > https://www.ietf.org/mailman/listinfo/netmod
> 
> --
> Juergen Schoenwaelder           Jacobs University Bremen gGmbH
> Phone: +49 421 200 3587         Campus Ring 1 | 28759 Bremen | Germany
> Fax:   +49 421 200 3103         <https://www.jacobs-university.de/>
> 
> _______________________________________________
> netmod mailing list
> netmod@ietf.org
> https://www.ietf.org/mailman/listinfo/netmod