RE: [RPSEC] Feedback on draft-behringer-bgp-session-req-01

I guess we have differing views on the definition of "security." If I
can classify based on a policy which provides me more resistance from
attacks, then that is a "security tool." Hence, GTSM is a security tool.

> -----Original Message-----
> From: Joe Touch [mailto:touch@ISI.EDU] 
> Sent: Thursday, June 21, 2007 1:34 PM
> To: rpsec@ietf.org
> Subject: [RPSEC] Feedback on draft-behringer-bgp-session-req-01
> 
> Hi, all,
> 
> The following feedback was requested on the TCPM's 
> TCP-AUTH-DT (TCP-Auth design team) mailing list. TCP-Auth is 
> TCMP's work towards an update to TCP-MD5, based on two 
> current proposals (noted below).
> 
> Joe
> 
> ---------------------------------------------
> 
> This document appears to overlap ongoing work in TCPM to 
> characterize concerns with using TCP-MD5 to secure BGP, and 
> use of alternatives.
> E.g., draft-ietf-tcpm-antispoof. The TCP-Auth team is 
> currently workiing to revise draft-bellovin-tcpsec, and an 
> update to that should be out shortly.
> 
> Some additional comments:
> 
> Sec 1 - the OSI stack is not the reference model for the Internet.
> GTSM is not IP layer security; it is a heuristic that checks 
> TTLs in IP packets, and assumes that there is other security 
> protecting tunnels to a host. It would be more appropriate to 
> cite IPsec as IP security, and GTSM as "other protection mechanisms".
> 
> Other work in this area:
> 	- draft-ietf-tcpm-antispoof (as noted above)
> 	- draft-ietf-tcpm-tcpsecure
> 	- draft-bellovin-tcpsec
> as well as specific proposals to update TCP-MD5:
> 	- draft-touch-tcpm-tcp-simple-auth
> 	- draft-bonica-tcp-auth
> 
> Further, to a large extent, the preference of router managers 
> to avoid IPsec was the motivation behind BTNS:
> 	- http://www.ietf.org/html.charters/btns-charter.html
> See also the problem and applicability statement:
> 	- draft-ietf-btns-prob-and-applic
> 
> draft-bellovin-tcpsec should be cited in "Dependence on the 
> MD5 algorithm...", as well as RFC4808
> 
> 3.2 - IPsec = RFC4301
> in addition to Bonica's proposed alternative, please include 
> mine   ;-)   :
> draft-touch-tcpm-tcp-simple-auth
> 
> 3.3 - "This requirement is currently..." - also by IPsec.
> 
> --
> ----------------------------------------
> Joe Touch
> Sr. Network Engineer, USAF TSAT Space Segment
> 
> 

_______________________________________________
RPSEC mailing list
RPSEC@ietf.org
https://www1.ietf.org/mailman/listinfo/rpsec