Shepherd writeup for draft-ietf-bfd-optimizing-authentication

"Reshad Rahman (rrahman)" <rrahman@cisco.com> Sun, 14 June 2020 18:50 UTC

Return-Path: <rrahman@cisco.com>
X-Original-To: rtg-bfd@ietfa.amsl.com
Delivered-To: rtg-bfd@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6868C3A0962; Sun, 14 Jun 2020 11:50:22 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -9.597
X-Spam-Level:
X-Spam-Status: No, score=-9.597 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=ebpzZOb8; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=c/2GXA+p
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id q4ZazfFlDCNC; Sun, 14 Jun 2020 11:50:20 -0700 (PDT)
Received: from alln-iport-6.cisco.com (alln-iport-6.cisco.com [173.37.142.93]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 41AB83A0949; Sun, 14 Jun 2020 11:50:20 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=20613; q=dns/txt; s=iport; t=1592160620; x=1593370220; h=from:to:subject:date:message-id:mime-version; bh=EL5PO3/PERQKKNDVMnCjANUu3Ky30hKTN5PKLnZQsgA=; b=ebpzZOb8nMOq4FzpiI8yc6Ji2ZG3uakQ2kav+N8Vc69zWzM8rvAv5/WR 0hUorWzBScisZynbh8GHdqNOdHjVeXEeltrXiJCLUjqJI7ryN5h2kUi51 iphWleMSrAUm10+7+16qKfU753hQ9tfXSMpvTtq4N3SOVmMENHipTnKAh s=;
IronPort-PHdr: =?us-ascii?q?9a23=3At6PHdxDVl/EQM2eXbH5PUyQJPHJ1sqjoPgMT9p?= =?us-ascii?q?ssgq5PdaLm5Zn5IUjD/qw01g3IUJnVrfVehLmev6PhXDkG5pCM+DAHfYdXXh?= =?us-ascii?q?AIwcMRg0Q7AcGDBEG6SZyibyEzEMlYElMw+Xa9PBtUFdrwIVrIrS764TsbAB?= =?us-ascii?q?6qMw1zK6z8EZLTiMLi0ee09tXTbgxEiSD7b6l1KUC9rB7asY8dho4xJw=3D?= =?us-ascii?q?=3D?=
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0B9BQCTcOZe/5JdJa1mHAEBAQEBAQc?= =?us-ascii?q?BARIBAQQEAQGCCoEjL1EHb1gvLAqEGoNGA6EnhGiCUgNVCwEBAQwBASUIAgQ?= =?us-ascii?q?BAYREGYIVAiQ4EwIDAQELAQEFAQEBAgEGBG2FWwyGCxEdAQE4EQEGMhICBDA?= =?us-ascii?q?nBAExA4MEAYF+TQMuAQ6XNpBoAoE5iGF2gTKDAQEBBYFGQYMVGIIOAwaBOIJ?= =?us-ascii?q?khxuCSxqBQT+BEScchWcCAwGCCCKCRTOCLZIjhjeLIZBGCoJZBIg4kF8DHYJ?= =?us-ascii?q?wiRqFGo1DkReKCpQjAgQCBAUCDgEBBYFqIoFWcBUaSwGCPlAXAg2OHgsCFoN?= =?us-ascii?q?OhRSFQnQ3AgYBBwEBAwl8jiSBDwGBEAEB?=
X-IronPort-AV: E=Sophos;i="5.73,512,1583193600"; d="scan'208,217";a="524992083"
Received: from rcdn-core-10.cisco.com ([173.37.93.146]) by alln-iport-6.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 14 Jun 2020 18:50:19 +0000
Received: from XCH-RCD-003.cisco.com (xch-rcd-003.cisco.com [173.37.102.13]) by rcdn-core-10.cisco.com (8.15.2/8.15.2) with ESMTPS id 05EIoJGJ001027 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Sun, 14 Jun 2020 18:50:19 GMT
Received: from xhs-rtp-001.cisco.com (64.101.210.228) by XCH-RCD-003.cisco.com (173.37.102.13) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Sun, 14 Jun 2020 13:50:18 -0500
Received: from xhs-rtp-002.cisco.com (64.101.210.229) by xhs-rtp-001.cisco.com (64.101.210.228) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Sun, 14 Jun 2020 14:50:17 -0400
Received: from NAM10-MW2-obe.outbound.protection.outlook.com (64.101.32.56) by xhs-rtp-002.cisco.com (64.101.210.229) with Microsoft SMTP Server (TLS) id 15.0.1497.2 via Frontend Transport; Sun, 14 Jun 2020 14:50:17 -0400
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Z+n5xvW1PUbXduXW4rbOSb2P3XnVgAPC9w8j+hV3D/OpFbvEFMxHud/R5h7mgURz+zkmnC3tknh3/3C2FRjV/3E3RzZeLVXZZ+8Ae+mDKGnrLmtN/I+mqzNgGcH9g3Hnf7lyIFS5abFkjQ7Z0RSnBKZdW8ngN92CqHgAs9E67gJBqMxdvf3Ak+k8q0eKkgpXMczP3zuQjX2F9TpJrzCBXsChrkDxBUbA/qoe/TCmMfZXRY07fl3isTyHrC0hTMW4nZEtEMkng5DNF5bGhjYKCwFFUkmu9CpRaeghv3mKdmfYh1L5mjKi25DIXrjGTcwzQgz1Ls7HQTRSLCKe5DmJ2Q==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=EL5PO3/PERQKKNDVMnCjANUu3Ky30hKTN5PKLnZQsgA=; b=iL3IQWO2rwkr5FsNrGIGQat87051A35qxqgB6VP2Oy4UMkC9KPMHaHuCoLONI5YQxamsXb1EB68Sq/oAORAnW0GC8q7Jcni2bMzIM29QUyTVETPwWwleMKSI4lAdoPCtugD4gL/p8PQjpdHb+vn+iFzaPe9J8y71l/HfUynZRM5Zn9AVQzPKIXmJ17roWEdTMmrWzoK3991mJXvjZ9MXZi6sHtLPUb1ipU357Hus4mhoJDOur9++nyr4bxvj4mU7b3p2C3rHDtfiXOAXNCJiyMeqoS6GzFzr45dxORpvyHJhC+L2RSVaYgOMo3B0Z93QyavAcbu+co1cKfT64u+6uw==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cisco.com; dmarc=pass action=none header.from=cisco.com; dkim=pass header.d=cisco.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=EL5PO3/PERQKKNDVMnCjANUu3Ky30hKTN5PKLnZQsgA=; b=c/2GXA+ppTPIdiL4rzPJPqdUb2ITd3A0ZCMTPOK/wqq8F63noJrzc7b69pfX8ZR8HLbCmq6MhL26iXsVxL7FRzJu48zLLsOizk2308RBJVBkeWfPoBun9zm58k5nkTxjkRamDPC8CCluUkEzughX8pcwFoeUA47OUGdj1SCseAQ=
Received: from BN6PR11MB3875.namprd11.prod.outlook.com (2603:10b6:405:80::37) by BN6PR11MB3953.namprd11.prod.outlook.com (2603:10b6:405:7f::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3088.21; Sun, 14 Jun 2020 18:50:16 +0000
Received: from BN6PR11MB3875.namprd11.prod.outlook.com ([fe80::3076:a505:335e:a8ff]) by BN6PR11MB3875.namprd11.prod.outlook.com ([fe80::3076:a505:335e:a8ff%6]) with mapi id 15.20.3088.027; Sun, 14 Jun 2020 18:50:16 +0000
From: "Reshad Rahman (rrahman)" <rrahman@cisco.com>
To: "rtg-bfd@ietf.org" <rtg-bfd@ietf.org>, "draft-ietf-bfd-optimizing-authentication@ietf.org" <draft-ietf-bfd-optimizing-authentication@ietf.org>
Subject: Shepherd writeup for draft-ietf-bfd-optimizing-authentication
Thread-Topic: Shepherd writeup for draft-ietf-bfd-optimizing-authentication
Thread-Index: AQHWQnykt4YmkJxKckmHBhtY2tCNmw==
Date: Sun, 14 Jun 2020 18:50:16 +0000
Message-ID: <86B2BDA3-B8BC-4ABF-A073-30844E7254FD@cisco.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
user-agent: Microsoft-MacOutlook/16.37.20051002
authentication-results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=cisco.com;
x-originating-ip: [70.31.50.95]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: 9960bc84-9371-4614-a06d-08d81093c773
x-ms-traffictypediagnostic: BN6PR11MB3953:
x-microsoft-antispam-prvs: <BN6PR11MB395310926130C266561204FBAB9F0@BN6PR11MB3953.namprd11.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:2733;
x-forefront-prvs: 04347F8039
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: LDHnijgVdlOIdqWzn5BbN5OkRbHmfomjdFsNmMhh6x2KupR4auHbWqo5kJG/o1Cx68ZTR7F0IE/Z7XmcyMdrDcwTiroWbN2iwyL0hGtJXSOwfID+dPwmk9N1pohum1kjfzObU2MJUpGJE+75nkAVYmdoTv7bT4WAR9fVUQd1xRkO2imV+Pd7RAwdPOy3Dy/ppTR6ZrC/Hp3bN0fPxj7wuudmKhaFrIhxJSwSx7oWHp81wXRYp9OT256k5mlhKgt6TFWjbA7ZowWeDoUTSEkzBoHwZZe+iyHXAJZotXeCPdv4OMoqahhlO94dyKe1A+lbrqUuD78toW1f5vHTcOgWNdlj7GbV/UJg7TeSFlYctVCjRFTs9NEQ0onI7gVznOtkvitCsqda3VQ6KR3+RiCbHQ==
x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BN6PR11MB3875.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(136003)(366004)(39860400002)(396003)(346002)(376002)(66946007)(2616005)(66476007)(66556008)(64756008)(66446008)(91956017)(478600001)(2906002)(316002)(8936002)(6486002)(36756003)(186003)(6506007)(76116006)(6512007)(966005)(450100002)(26005)(86362001)(33656002)(71200400001)(166002)(8676002)(5660300002)(110136005)(83380400001); DIR:OUT; SFP:1101;
x-ms-exchange-antispam-messagedata: bYb96ijcvoyCvpmIhMWMn9otNZxLzQUrGbHKcdSI1vri7NIYlXtGIrAkrZK9a+QjxNYR3CFIbNXViFHAjSuh/WZist1IcXJllnrgSac+tbvsj/jo+ELsfmM1Wood7juHuGgDVbSuouOmraKgOWK07lZ8GCG322F6k1H8g/tyAarVFEEkXYuNKTbv6JdLJLSDCJeCB1S/LOR/eG7mCMu4vGWwAmu/2kEQOByUnE5PqowRqs4nwMf0aRaS+/ge8GcfGDFo/HftZUyONW/9rhAHG1+nxjXRtvlaQLa7YxrG7b1aYaVYxDx9IqQbPwu3uqHt2kMiU96Jy5JaJKx8onwgoZVru1NnLkQUVTahDD8SH/xy0hx5lt/wWEeJBs4fsxrSCxCWJ4JxBLM3Ujug1d92DMkaADhh1/A/Pkbd7xe/W0DPQH8QWFvogJLY6pXaFt5uwP4iRg9/Nk0L0zb9yjXV7ZLtUObzjaZ/IcdgF2K3bOs=
x-ms-exchange-transport-forked: True
Content-Type: multipart/alternative; boundary="_000_86B2BDA3B8BC4ABFA07330844E7254FDciscocom_"
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 9960bc84-9371-4614-a06d-08d81093c773
X-MS-Exchange-CrossTenant-originalarrivaltime: 14 Jun 2020 18:50:16.4906 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: Mk4X5sW2ARC6jUqg1CnW1APL7ba9dzqPLE189AKCyBXMyQhx7MnvUG/91Tv5vS8fSh2No5MMjjuMcdmVHEznmg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN6PR11MB3953
X-OriginatorOrg: cisco.com
X-Outbound-SMTP-Client: 173.37.102.13, xch-rcd-003.cisco.com
X-Outbound-Node: rcdn-core-10.cisco.com
Archived-At: <https://mailarchive.ietf.org/arch/msg/rtg-bfd/FhRNdKREfO2kJ7jFNt2sIeQ9ftM>
X-BeenThere: rtg-bfd@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "RTG Area: Bidirectional Forwarding Detection DT" <rtg-bfd.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/rtg-bfd>, <mailto:rtg-bfd-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/rtg-bfd/>
List-Post: <mailto:rtg-bfd@ietf.org>
List-Help: <mailto:rtg-bfd-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/rtg-bfd>, <mailto:rtg-bfd-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 14 Jun 2020 18:50:24 -0000

Authors, WG,

The writeup is available at https://datatracker.ietf.org/doc/draft-ietf-bfd-optimizing-authentication/

For convenience I’ve copied the comments on the document below.

Regards,
Reshad.


General:

  *   Updates RFC5880 missing from title page
  *   Replace BFD frames by BFD packets or BFD control packets. Don’t use frames since RFC5880 uses packets.
  *   Use of term Null-authentication TLV. RFC5880 uses authentication section, doesn’t mention auth TLV.



Abstract:

Mention that this document updates RFC5880.



Requirements Language

Please put this is a separate (sub)section later, e.g. after introduction.



Introduction

First paragraph: s/is computationally intensive process/is a computationally intensive process/

Split first sentence into 2, e.g.

   Authenticating every BFD [RFC5880] packet with a Simple Password, or

   with a MD5 Message-Digest Algorithm [RFC1321], or Secure Hash

   Algorithm (SHA-1) algorithms is a computationally intensive process.

   This makes it difficult, if not impossible, to authenticate every packet,

   particularly at faster rates.



2nd paragraph: “… only BFD frames that signal a state change in BFD be authenticated.” State change is not 100% correct since P/F/D bit changes aren’t state changes (as mentioned in more detail below in section 2 comments). What about this instead: “State change, a demand mode change (to D bit) or a poll sequence change (P or F bit change) in a BFD packet are categorized as a significant BFD change. This document proposes that all BFD control packets which signal a significant BFD change MUST be authenticated if the session’s bfd.AuthType is non-zero. Other BFD control packets MAY be transmitted and received without the A bit set.” If you do use “significant BFD change”, add it to terminology section.

s/non-state change frame/BFD control packets without state or D/F/P bit change/, e.g.

“To detect a Man In the Middle (MITM) attack, it is also proposed that BFD control packets without a significant change be authenticated occasionally.  The interval of these control packets…”



Section 2

POLL and DEMAND are NOT strictly states. POLL refers to “Poll sequence” as specified in section 6.5 of RFC5880. DEMAND refers to “Demand mode” as specified in section 6.6 of RFC5880. In the table, the POLL entry refers to polling sequence enabled and in any BFD state. Likewise, the DEMAND entry refers to Demand mode. This means that a session in UP state, in demand mode and polling sequence enabled will match 3 entries in that table. It’s a bit confusing. Here’s what I suggest instead:

  1.  Take POLL out of the table. Add a paragraph mentioning that if P or F bit changes value, the packet MUST be authenticated
  2.  Take DEMAND out of the table. Add a paragraph mentioning that if D bit changes value, the packet MUST be authenticated



Another comment on the table. The text says it should be read as state change from column to row. Column INIT to row UP is n/a whereas column UP to row INIT is Auth. INIT to UP is a valid transition, UP to INIT is not (has to go through DOWN first). So I think those entries should be reversed in the table.



Last paragraph: CC frames is not defined in BFD, use “control packets” instead?



Section 3

Sequence number mentions “as defined in [RFC5880]”. Suggest mentioning bfd.XmitAuthSeq



Security Considerations.

I believe this needs to be beefed up:

  1.  Use of sequence number for non-authenticated frames. Secure sequence numbers even better.
  2.  Mention (again) that non-authenticated BFD packets which have a significant change (state, D/F/P) are dropped. So if someone injects a non-authenticated packet with Down state to take down the session, that won’t work.



Section 6.2

RFC5880 should be a normative reference.