Re: [RPSEC] BGP Security Requirements v08

[Stephen Kent <[e-mail]>]

At 2:35 PM -0700 7/10/07, Tony Tauber wrote:
>Hi Steve,
>
>As usual your detailed comments were helpful.
>Comments are inline.
>
>On Tue, Jul 10, 2007 at 11:38:44AM -0400, Stephen Kent wrote:
>>  Tony,
>>
>>  Thanks for updating the requirements document. I see that almost all
>>  of my suggested edits were incorporated, but a couple of questions I
>>  raised in my comments were not addressed, which leaves some
>>  ambiguity.  Here are the residual questions/comments:
>>
>>  In (new) section 4.2 (Incremental Deployment), the second bullet says:
>>
>  > o  A BGP security mechanism MUST provide backward compatibility in
>>  the message formatting, transmission, and processing of routing
>>  information carried through a mixed security environment.  Message
>>  formatting in a fully secured environment MAY be handled in a
>>  non-backward compatible fashion though care must be taken to ensure
>>  UPDATES can traverse intermediate routers which don't support the new
>  > format.
>>
>>  My comment was:  One might interpret this to mean that any extended
>>  form of UDATE message MUST be transmitted through ASes that are not
>>  capable of processing it. This is imposing an unnecessary burden on
>>  solutions, since an alternative is to just mot send such messages
>>  through ASes than can't make use of them.
>
>I see this requirement as a (possibly unnecessary) corollary to the
>requirement for supporting non-contiguous deployments.  The fact that
>the interpretation is ambiguous about how specifically one achieves this
>goal (perhaps properly) reflects the fact that solutions can get
>creative.

I worried that one might interpret the requirement as imposing an 
undue restriction on solutions, by requiring that solutions be able 
to send UPDATEs with a modified format through ASes that might not be 
able to process a new format. We seem to be in agreement that one 
ought not impose such requirements on solutions. If so, then how 
about rewording this bullet to say:

"A BGP security mechanism MUST provide backward compatibility in
the message formatting, transmission, and processing of routing
information carried through a mixed security environment.  Message
formatting in a fully secured environment MAY be handled in a
non-backward compatible fashion. Care must be taken to ensure either that
UPDATES can traverse intermediate routers which don't support the new
format, or that UPDATEs using a new format are not sent to ASes that cannot
support such messages."

>...
>  >
>>  The next bullet in the section says:
>>
>  > In an environment where both secured and non-secured systems are
>>  interoperating a mechanism MUST exist for secured systems to identify
>  > whether an originator intended the information to be secured.
>>
>>  My questions was: Does this refer to the Origin AS or the neighbor AS?
>>
>>  I still think we need to say to which originator this bullet refers.
>
>My reading of it would be "originator".  I didn't find it ambiguous.
>
>Perhaps you or someone else could suggest clearer text if needed.

To avoid ambiguity I would suggest:

"In an environment where both secured and non-secured systems are
interoperating a mechanism MUST exist for secured systems to identify
whether the origin AS for a route intended the routing information 
being transmitted to be secured."

Steve


_______________________________________________
RPSEC mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/rpsec