Re: [RPSEC] BGP Security Requirements v08

In message <C35ADD020AEBD04383C1F7F644227FDF04028C86@xmb-sjc-227.amer.cisco.com>
"Barry Greene \(bgreene\)" writes:
>  
>  
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>  
> In the last draft it was pretty clear.  

Are we reading the same draft?  It would be nice to have the draft
name in the subject line.

In draft-ietf-rpsec-bgpsecrec-08 the only mention of GTSM is the
following and there is no mention of the issue of high volume DOS.

   Current
   approaches to improving resilience of BGP transport (e.g., TCP-MD5
   [5] and GTSM [7]) are inadequate and require significant operator
   interaction to maintain a respectable level of security.

The draft is in denial regarding the existance of DOS issues, the
existing means to address DOS, and the fact that DOS is not addressed
by crypto methods.

I keep bringing this up and nothing changes.

Curtis

> > -----Original Message-----
> > From: Joe Touch [mailto:touch@ISI.EDU] 
> > Sent: Thursday, July 12, 2007 11:57 PM
> > To: curtis@occnc.com
> > Cc: rpsec@ietf.org; Tony Tauber
> > Subject: Re: [RPSEC] BGP Security Requirements v08
> > 
> > 
> > 
> > Curtis Villamizar wrote:
> > ...
> > > GTSM is very effective in protecting against certain high volume 
> > > attacks that would cripple infrastructure protected by 
> > cryptographic 
> > > means alone.  From a practical standpoint GTSM used alone may be 
> > > inadequate as a solution (though some ISPs might contest even
> > > that)  but it is a required part of any solution in an ISP
> > > environment.  
> > > 
> > > Curtis
> > 
> > I agree that DOS attacks benefit from protections that help 
> > reduce the impact of attack traffic; GTSM falls into that 
> > category - it's clearly a useful part of a DOS solution, but 
> > DOS protection isn't cryptographic protection. The bulk of 
> > the BGP security requirements document focuses on 
> > cryptographic issues - not DOS protection. It's worth noting 
> > the difference, but not lumping the solutions together.
> > 
> > Joe
> > 
> > --
> > ----------------------------------------
> > Joe Touch
> > Sr. Network Engineer, USAF TSAT Space Segment

_______________________________________________
RPSEC mailing list
RPSEC@ietf.org
https://www1.ietf.org/mailman/listinfo/rpsec