Re: [Pce] Roman Danyliw's Discuss on draft-ietf-pce-stateful-pce-p2mp-12: (with DISCUSS)

[Dhruv Dhody <[e-mail]>]

Hi Ramon, 

Thanks for your review. 

Here is the proposed update - 

12.  Security Considerations

   The stateful operations on P2MP TE LSPs are more CPU-intensive and
   also utilize more bandwidth on wire (in comparison to P2P TE LSPs).
   If a rogue PCC were able to request unauthorized stateful PCE
   operations then it may be able to mount a DoS attack against a PCE,
   which would disrupt the network and deny service to other PCCs.
   Similarly an attacker may flood the PCC with PCUpd messages at a rate
   that exceeds either the PCC's ability to process them or the
   network's ability to signal the changes, by either spoofing messages
   or compromising the PCE itself.

   Consequently, it is important that implementations conform to the
   relevant security requirements as listed below -

   o  As per [RFC8231], it is RECOMMENDED that these PCEP extensions
      only be activated on authenticated and encrypted sessions across
      PCEs and PCCs belonging to the same administrative authority,
      using Transport Layer Security (TLS) [RFC8253], as per the
      recommendations and best current practices in [RFC7525] (unless
      explicitly set aside in [RFC8253]).

   o  Security considerations for path computation requests and
      responses are as per [RFC8306].

   o  Security considerations for stateful operations (such as state
      report, synchronization, delegation, update, etc.) are as per
      [RFC8231].

   o  Security considerations for LSP instantiation mechanism are as per
      [RFC8231].

   o  Security considerations as stated in Section 10.1, Section 10.6,
      and Section 10.7 of [RFC5440] continue to apply.


More inline - 

> -----Original Message-----
> From: Pce [mailto:[e-mail]] On Behalf Of Roman Danyliw via
> Datatracker
> Sent: 10 April 2019 20:00
> To: The IESG <[e-mail]>
> Cc: [e-mail]; [e-mail]; pce-
> [e-mail]
> Subject: [Pce] Roman Danyliw's Discuss on draft-ietf-pce-stateful-pce-
> p2mp-12: (with DISCUSS)
> 
> Roman Danyliw has entered the following ballot position for
> draft-ietf-pce-stateful-pce-p2mp-12: Discuss
> 
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
> 
> 
> Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
> for more information about IESG DISCUSS and COMMENT positions.
> 
> 
> The document, along with other ballot positions, can be found here:
> https://datatracker.ietf.org/doc/draft-ietf-pce-stateful-pce-p2mp/
> 
> 
> 
> ----------------------------------------------------------------------
> DISCUSS:
> ----------------------------------------------------------------------
> 
> The Security Considerations section has numerous helpful and appropriate
> references.  Thanks for tracking them down.  However, explicit, additional
> text is required to help identify, de-duplicate and deconflict the
> “relevant guidance” provided by them.
> 
> (1) Per “it is important that implementations conform to the relevant
> security requirements of [RFC5440], [RFC8306] and [RFC8231], and
> [RFC8281]”:
> 
> ** [RFC8231] says “RECOMMENDED that these PCEP extensions only be
> activated on authenticated and encrypted sessions across PCEs and PCCs
> belonging to the same administrative authority, using Transport Layer
> Security (TLS) [PCEPS], as per the recommendations and best current
> practices in [RFC7525]”.  Good language.
> This draft again re-states “Securing the PCEP session using Transport
> Layer Security (TLS) [RFC8253], as per the recommendations and best
> current practices in [RFC7525], is RECOMMENDED.”  Why say that twice?  Is
> there something new there?
> 

[[Dhruv Dhody]] Used the text from RFC8231. 

> ** Per Section 10.4 of RFC5440 from 2009, IPSec is a MAY and Section 10.2
> makes
> TCP-MD5 a MUST.  The more recent (2017) RFC8306 and RFC8253 reference TLS
> and TCP-AO, no IPSec.  RFC8306 explicitly says don’t use TCP-MD5.  What is
> the RECOMMENDED approach today?
> 
> (2) Per “[s]ecuring the PCEP session using Transport Layer Security (TLS)
> [RFC8253], as per the recommendations and best current practices in
> [RFC7525], is RECOMMENDED”, how should the guidance on both of these
> drafts be synthesized?  	

[[Dhruv Dhody]] Added "(unless explicitly set aside in [RFC8253])". 

> Specifically, this sentence is unclear on whether
> the the robust TLS 1.2 requirements in Section 3.4 of RFC8253 are
> RECOMMENDED, and/or whether the Security Considerations/Section 7 of
> RFC8253, which undermine these robust requirements by saying
> administrators MAY allow the usage weak ciphersuites, apply.  

[[Dhruv Dhody]] Section 3.4 of RFC8253 says - 

       *  Negotiation of a ciphersuite providing for confidentiality is
          RECOMMENDED.

Then, Section 7 says - 

   Some TLS ciphersuites only provide integrity validation of their
   payload and provide no encryption; such ciphersuites SHOULD NOT be
   used by default.  Administrators MAY allow the usage of these
   ciphersuites after careful weighting of the risk of relevant internal
   data leakage that can occur in such a case, as explicitly stated by
   [RFC6952].

The 'MAY' in the above text is to optionally allow going against something that is 'RECOMMENDED' with a suitable guidance. In my reading that is okay. Am I missing something?  

> This
> sentence also cites RFC7525 which makes statements that weak
> (NULL) cipher suites MUST NOT be negotiated in contradiction to the
> RFC8253 Section 7 guidance.
> 
[[Dhruv Dhody]] This is taken care by "(unless explicitly set aside in [RFC8253])" in the proposed update. 

> Given the discussion of TLs, some additional treatment of TLS v1.3 is
> needed, recognizing that RFC7525 does recommend “v1.2+”
> 
[[Dhruv Dhody]] Both RFC8253 and RFC7525 say TLS1.2 or later; not sure if we need to say more in this I-D (a very specific P2MP extension). 

> Again, there is helpful guidance across all of the references.  Please
> provide more textually narrative about which specific sections apply on
> the references.
> 
> 
[[Dhruv Dhody]] See proposed text. 

If the new text needs further changes, it would be very helpful if you could include the changes you would like to see.  

Thanks for your review! 

Regards! 
Dhruv

> 
> 
> _______________________________________________
> Pce mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/pce