Re: [RPSEC] Feedback on draft-behringer-bgp-session-req-01

Hi, Barry,

Barry Greene (bgreene) wrote:
> I guess we have differing views on the definition of "security." If I
> can classify based on a policy which provides me more resistance from
> attacks, then that is a "security tool." Hence, GTSM is a security tool.

GTSM could be classified as a security tool, but it is not IP layer
security. It is a mechanism an endpoint can use to increase its
resistance to attack, as you note, but it doesn't particularly protect
any single protocol layer or header.

Joe

>> -----Original Message-----
>> From: Joe Touch [mailto:touch@ISI.EDU] 
>> Sent: Thursday, June 21, 2007 1:34 PM
>> To: rpsec@ietf.org
>> Subject: [RPSEC] Feedback on draft-behringer-bgp-session-req-01
>>
>> Hi, all,
>>
>> The following feedback was requested on the TCPM's 
>> TCP-AUTH-DT (TCP-Auth design team) mailing list. TCP-Auth is 
>> TCMP's work towards an update to TCP-MD5, based on two 
>> current proposals (noted below).
>>
>> Joe
>>
>> ---------------------------------------------
>>
>> This document appears to overlap ongoing work in TCPM to 
>> characterize concerns with using TCP-MD5 to secure BGP, and 
>> use of alternatives.
>> E.g., draft-ietf-tcpm-antispoof. The TCP-Auth team is 
>> currently workiing to revise draft-bellovin-tcpsec, and an 
>> update to that should be out shortly.
>>
>> Some additional comments:
>>
>> Sec 1 - the OSI stack is not the reference model for the Internet.
>> GTSM is not IP layer security; it is a heuristic that checks 
>> TTLs in IP packets, and assumes that there is other security 
>> protecting tunnels to a host. It would be more appropriate to 
>> cite IPsec as IP security, and GTSM as "other protection mechanisms".
>>
>> Other work in this area:
>> 	- draft-ietf-tcpm-antispoof (as noted above)
>> 	- draft-ietf-tcpm-tcpsecure
>> 	- draft-bellovin-tcpsec
>> as well as specific proposals to update TCP-MD5:
>> 	- draft-touch-tcpm-tcp-simple-auth
>> 	- draft-bonica-tcp-auth
>>
>> Further, to a large extent, the preference of router managers 
>> to avoid IPsec was the motivation behind BTNS:
>> 	- http://www.ietf.org/html.charters/btns-charter.html
>> See also the problem and applicability statement:
>> 	- draft-ietf-btns-prob-and-applic
>>
>> draft-bellovin-tcpsec should be cited in "Dependence on the 
>> MD5 algorithm...", as well as RFC4808
>>
>> 3.2 - IPsec = RFC4301
>> in addition to Bonica's proposed alternative, please include 
>> mine   ;-)   :
>> draft-touch-tcpm-tcp-simple-auth
>>
>> 3.3 - "This requirement is currently..." - also by IPsec.
>>
>> --
>> ----------------------------------------
>> Joe Touch
>> Sr. Network Engineer, USAF TSAT Space Segment

Re: [RPSEC] Feedback on draft-behringer-bgp-session-req-01

Attachment: signature.asc