Re: [PWE3] Comment on Re: Starting WG adoption call for draft-boutros-pwe3-mpls-tp-mac-wd-02

> > Sami: This is one of the comments that we need to address for sure as we
> > progress the draft..
> >
> 
> This is a basic issue and it needs to be addressed before considering this
> to be a WG draft.
> 
> 
> >
> >
> > 2. You mention that there are no security considerations. What if this
> > packet is spoofed by say a man-in-the-middle attack ?
> >
> >
> > Sami: The reason here is that we will be using static PW-OAM and our
> > security will be no better or no worse that what this mechanism provide.
> >
> 
> MAC flush can be forwarded beyond the receiving PE. So the problem gets
> progressively worse. IMO we need to add security to PW-OAM (the alternative
> being to use a mechanism other than PW-OAM).

There is no security for the PW status bits either that are carried in this 
message, so one could just as easily inject a fault that would also induce the
equivalent of a mac flush. Or send standby and force a redundant VPLS switchover 
to another instance. These problems already exist with PW OAM; adding MAC flush 
is not making matters any worse as you could probably emulate a brute force flush 
by sending ac rx/tx faults...

The original intent was to keep the protocol simple, but if security is
a concern then it is a base concern with the protocol and we have to
look into adding some kind of digest or some other protocol all
together.

Thanks,

Neil.

> 
> 
> >
> > Thanks,
> >
> > Sami
> >
> >
> > On Mon, Jan 23, 2012 at 12:19 PM, Andrew G. Malis <amalis@gmail.com>
> > wrote:
> >  This begins a two-week PWE3 WG adoption call for
> > https://tools.ietf.org/html/draft-boutros-pwe3-mpls-tp-mac-wd-02 , ending
> > February 6. Please respond with your approval, disapproval, and other
> > comments to the PWE3 list. If you don't support the adoption, providing a
> > reason would be useful to the authors and the working group, but is not
> > required. Of course, the reason why you support the draft is also welcome,
> > but also optional. This request will be a part of PWE3 WG adoption calls
> > going forward.
> >
> > Thanks,
> > Andy and Matthew
> >
> >
> > _______________________________________________
> > pwe3 mailing list
> > pwe3@ietf.org
> >  https://www.ietf.org/mailman/listinfo/pwe3
> >
> >
> >
> >
> > --
> > - Sri
> > _______________________________________________
> > pwe3 mailing list
> > pwe3@ietf.org
> >  https://www.ietf.org/mailman/listinfo/pwe3
> >
> >
> >
> > _______________________________________________
> > pwe3 mailing list
> > pwe3@ietf.org
> > https://www.ietf.org/mailman/listinfo/pwe3
> >
> >
> 
> 
> -- 
> - Sri
> 