[OPSEC] additional documents needing a home...

Folks,

Dave Ward has proposed adding:

Michael Behringer's rpsec draft

http://tools.ietf.org/html/draft-ietf-rpsec-bgp-session-sec-req-01

   Abstract

   The document "BGP security requirements" (draft-ietf-rpsec-bgpsecrec)
   specifies general security requirements for BGP.  However, specific
   security requirements for single BGP sessions, i.e., the connection
   between two BGP peers, are only touched on briefly in the section
   "transport layer protection".  This document expands on this
   particular aspect of BGP security, defining the security requirements
   between two BGP peers.

which as was presented in opsec in ireland

and

http://tools.ietf.org/html/draft-manral-rpsec-existing-crypto-05

   Abstract

   Routing protocols are designed to use cryptographic mechanisms to
   authenticate data being received from a neighboring router to ensure
   that it has not been modified in transit, and actually originated
   from the neighboring router purporting to have originating the data.
   Most of the cryptographic mechanisms defined to date rely on hash
   algorithms applied to the data in the routing protocol packet, which
   means the data is transported, in the clear, along with a signature
   based on the data itself.  These mechanisms rely on the manual
   configuration of the keys used to seed, or build, these hash based
   signatures.  This document outlines some of the problems with manual
   keying of these cryptographic algorithms.

http://tools.ietf.org/html/draft-bhatia-manral-igp-crypto-requirements-00

   Abstract

   The interior gateway routing protocols OSPFv2 [RFC2328], IS-IS [ISO]
   [RFC1195] and RIP [RFC2453] currently define clear text and MD5
   [RFC1321] algorithms for authenticating their protocol packets. There
   have recently been documents adding support of the SHA family of hash
   algorithms for authenticating routing protocol packets for RIP, IS-IS
   and OSPF.

   To ensure interoperability between disparate implementations, it is
   imperative that we specify a set of mandatory-to-implement algorithms
   thereby ensuring that there is at least one algorithm that all
   implementations will have available.

which were not...

As these document existing practice or problems with existing protocols
I think it is conceivable that this work would fall within our proposed
and soon to be official charter.

I would like to hear some opinions on the subject. there was some
discussion of the first document during the opsec wg meeting and I
believe that the record shows some support for and against housing it in
opsec.

thanks
joelja
_______________________________________________
OPSEC mailing list
OPSEC@ietf.org
https://www.ietf.org/mailman/listinfo/opsec