Re: [RTG-DIR] RtgDir review: draft-ietf-intarea-provisioning-domains-09

[Tommy Pauly <[e-mail]>]

Hi Russ,

Thanks for your review! We've posted a new -10 version (https://tools.ietf.org/html/draft-ietf-intarea-provisioning-domains-10) that should address your comments.

> On Dec 16, 2019, at 5:43 PM, [e-mail] wrote:
> 
> Hello,
>  
> I have been selected as the Routing Directorate reviewer for this draft. The Routing Directorate seeks to review all routing or routing-related drafts as they pass through IETF last call and IESG review, and sometimes on special request. The purpose of the review is to provide assistance to the Routing ADs. For more information about the Routing Directorate, please see ​http://trac.tools.ietf.org/area/rtg/trac/wiki/RtgDir <http://trac.tools.ietf.org/area/rtg/trac/wiki/RtgDir>
>  
> Although these comments are primarily for the use of the Routing ADs, it would be helpful if you could consider them along with any other IETF Last Call comments that you receive, and strive to resolve them through discussion or by updating the draft.
>  
> Document: draft-ietf-intarea-provisioning-domains-09
> Reviewer: Russ White
> Review Date: 16 December 2019
> Intended Status: Standards Track
>  
> Summary:
>  
> I have some minor concerns about this document that I think should be resolved before publication.
>  
> Comments:
>  
> The draft is very readable, explaining the problems being addressed, the various options, and the solution in clear and precise language. 
>  
> Major Issues:
>  
> No major issues found.
>  
> Minor Issues:
>  
> This is really more of a possible addition rather strictly being an issue. Section 3.4.4 notes the importance of not allowing DNS queries for PvD information to leak into recursive DNS servers. There are security issues here that are not mentioned, but might be worth mentioning. Specifically, if a DNS query for PvD information is somehow leaked into the recursive DNS system, it could reveal information about the querying hosts which could present a security breach.
>  
> This would just be another reason to be added to this section as justification, and potentially added to the security considerations section.

We've added some text here that specifically calls out the concern for leaking the resolution of the PvD Additional Information server name itself, with a reference to section 4.1 that also has text requiring that the query be performed to the PvDs resolver. We've also added a new paragraph to the Privacy Considerations section mentioning this concern.

>  
> A second area to consider here is that it might be good to mention having a filter or mechanism on the implementing router that allows the user to configure filtering PvD information so it is only ever transmitted to attached hosts. It may be that some outside attacker could use this information to find attack surfaces or do network discovery to prepare for an attack, so it might be best to allow the user to keep this information "private" to only the intended recipients in some way or another. The network operator shouldn't really be using this information to query PvD information, but rather should be using some management interface, so this should not impair it's use in any way. This may be covered in section 7, but it might need to be a bit more explicit (?).

Thanks for the suggestion! We added a paragraph to the Privacy Considerations to make this filtering a SHOULD.

Best,
Tommy

>  
> /r