Re: [pim] Stephen Farrell's Discuss on draft-ietf-pim-rfc4601bis-05: (with DISCUSS)

Hi, Spenser,

On 28/05/2015 9:21 AM, Spencer Dawkins at IETF wrote:
> Hi, Stephen,
>
> On Tue, May 26, 2015 at 9:59 AM, Stephen Farrell
> <stephen.farrell@cs.tcd.ie <mailto:stephen.farrell@cs.tcd.ie>> wrote:
>
>
>
>     On 26/05/15 15:29, Brian Haberman wrote:
>     > Hi Stephen,
>     >
>     > On 5/26/15 9:08 AM, Stephen Farrell wrote:
>     >> Stephen Farrell has entered the following ballot position for
>     >> draft-ietf-pim-rfc4601bis-05: Discuss
>     >>
>     >> When responding, please keep the subject line intact and reply
>     to all
>     >> email addresses included in the To and CC lines. (Feel free to
>     cut this
>     >> introductory paragraph, however.)
>     >>
>     >>
>     >> Please refer to
>     https://www.ietf.org/iesg/statement/discuss-criteria.html
>     >> for more information about IESG DISCUSS and COMMENT positions.
>     >>
>     >>
>     >> The document, along with other ballot positions, can be found here:
>     >> https://datatracker.ietf.org/doc/draft-ietf-pim-rfc4601bis/
>     >>
>     >>
>     >>
>     >>
>     ----------------------------------------------------------------------
>     >> DISCUSS:
>     >>
>     ----------------------------------------------------------------------
>     >>
>     >>
>     >>
>     >> 4601 used IPsec AH for it's MTI security. This removes that and
>     >> points at 5796 which defines how to use ESP for link local
>     >> addresses and with manual keying. That raises one technical
>     >> question and two ickky process questions. The ickky process
>     >> questions are probably best discussed between the IESG at least
>     >> initially in case we don't need to bother the authors/wg with
>     >> 'em.
>     >>
>     >> (1) I'd like to check that 5796 defines a way in which one can
>     >> secure all PIM messages that are defined here in 4601bis (should
>     >> one want to do that). If there are cases where PIM-SM can be
>     >> used and where there is no well defined security then I think
>     >> that would be a problem. And I think maybe there are such cases.
>     >> Am I wrong? If not, then how does one secure those?
>     >
>     > 5796 focuses on the link-local messages (i.e., directly-connected
>     > peers), but does say
>     >
>     >    Securing the unicast messages can be achieved by the use of a
>     normal
>     >    unicast IPsec Security Association (SA) between the two
>     communicants.
>     >
>     > The above refers to the set of PIM messages that are not sent as
>     > link-local.  My opinion is that this is sufficient given the
>     uses of PIM
>     > as defined in 4601.
>
>     Hmm. So you're saying that the way to secure PIM-SM is to have a set
>     of unicast IPsec SAs that cover all of the routers in the MC group?
>     That seems a bit odd doesn't it?
>
No, it's a set of unicast IPsec SAs that cover all of the
_routers_closest_to_senders_ in the MC group.  For the cases where
multicast really makes a difference (i.e., few senders, many receivers)
this is likely to be a much smaller set.

  Bill
>
>
>     >> (2) Is it ok for an IS to depend on a PS for it's MTI security
>     >> mechanism? (I think it is, but yeah, someone else might not.)
>     >
>     > I don't see why not.
>
>     I agree I think, but would like to check if that's an IESG opinion
>     or just you and me. (Can be done on the call.)
>
>
> We can talk about it on the call, but I'm agreeing with you and with
> Barry, as is Alvero.
>
> Spencer
>  
>
>     >
>     >>
>     >> (3) Is it ok for an IS to not conform to BCP107? (I think it
>     >> depends, and I'm not sure in this case.)
>     >
>     > I am not sure how BCP 107 relates since it discusses Guidelines for
>     > Cryptographic Key Management and the crypto stuff is now
>     referred to via
>     > 5796.
>
>     Abstract of 5796 says it only supports manual keying. BCP107 says
>     you have to define automated keying (with some exceptions into which
>     PIM-SM doesn't fit). Those do seem to be in conflict I think.
>
>     S.
>
>
>     >
>     > Regards,
>     > Brian
>     >
>
>
>
>
> _______________________________________________
> pim mailing list
> pim@ietf.org
> https://www.ietf.org/mailman/listinfo/pim

-- 
Dr. J.W. Atwood, Eng.             tel:   +1 (514) 848-2424 x3046
Distinguished Professor Emeritus  fax:   +1 (514) 848-2830
Department of Computer Science
   and Software Engineering
Concordia University EV 3.185     email:william.atwood@concordia.ca
1455 de Maisonneuve Blvd. West    http://users.encs.concordia.ca/~bill
Montreal, Quebec Canada H3G 1M8