Re: [OPSEC] Alvaro Retana's Discuss on draft-ietf-opsec-urpf-improvements-03: (with DISCUSS and COMMENT)

[Alvaro Retana <[e-mail]>]

Thanks Sriram!

I’m clearing my DISCUSS.

Alvaro.

On August 30, 2019 at 1:28:22 PM, Sriram, Kotikalapudi (Fed) (
[e-mail]) wrote:

Alvaro,

A new version -04 has been uploaded that includes changes
based on your Discuss and other comments.
It took sometime because we (authors) thought it was best to
incorporate all of the IESG reviewers' comments before uploading
a new version. That is done now.

>....
>Given that Algorithm B is more flexible, and that the limitations from
Algorithm A are overcome (§3.4), I would like to see B be the
recommendation.
>...
>I am ok if Algorithm A is mentioned as an alternative (not a
recommendation); one that is less flexible and has specific limitations —
even if those limitations are not expected/assumed, the vulnerability to a
change in conditions should be clearly spelled out.
>...

These main changes per your recommendation are incorporated.
Please take a look at the revised Section 3.7, where we've added
a new Section 3.7.1 to speak about applicability and limitations of
Algorithm A.
You may take a look at the diff:
https://tools.ietf.org/rfcdiff?url2=draft-ietf-opsec-urpf-improvements-04.txt

>Yes…but it is important to clearly mention the known vulnerabilities of
the solutions being proposed.

We have carefully revised the Security Considerations section.
There we mention again the limitations of Algorithm A
and refer back to Section 3.7.1 for details.
We also discuss (in the Security Considerations) the risks
of augmenting the RPF list based on ROA data (per your suggestion).
We also mention the need for "security hardening of
routers and other supporting systems (e.g., Resource PKI (RPKI) and
ROA management systems) against compromise..."

Please let us know if you have any additional comments.
Thanks very much for your help.

Sriram