Secdir early review of draft-ietf-rtgwg-atn-bgp-12

[Russ Housley via Datatracker <[e-mail]>]

Reviewer: Russ Housley
Review result: Has Issues

I reviewed this document as part of the Security Directorate's ongoing
effort to review all IETF documents being processed by the IESG.  These
comments were written primarily for the benefit of the Security Area
Directors.  Document authors, document editors, and WG chairs should
treat these comments just like any other IETF Last Call comments.

Document: draft-ietf-rtgwg-atn-bgp-12
Reviewer: Russ Housley
Review Date: 2022-01-18
Early Review Due: 2022-02-11
IETF LC End Date: Unknown
IESG Telechat date: Unknown


Summary: Has Issues


Major Concerns:

Section 3 says:

   The only requirement is that ASNs
   must not be duplicated within the ATN/IPS routing system itself.

What party will administer these ASNs?  I understand why it does not
need to be IANA, but there does need to be a single authority, even
if a hierarchy is used to delegate assignments.  ASN collisions are
extremely harmful.

Section 10 says:

   BGP protocol message exchanges and control message exchanges used for
   route optimization must be secured to ensure the integrity of the
   system-wide routing information base.

I assume that "secured" means integrity protected.  BGP runs over TCP.
TCP-AO was defined primarily to provide integrity protection for BGP.
Is the intent to use TCP-AO or something else.  Please specify.


Minor Concerns:

Section 1 talks about IPsec and Wireguard as "secured encapsulations".
Please say what you mean by security here.  Are you expecting
confidentiality, integrity, or both?  Since this is an example,
please drop "Wireguard" or provide a reference for it.

Section 1 goes on to say:

   In particular, tunneling must be used when
   neighboring ASBRs are separated by multiple INET hops.
   
This seems to mean that tunnels are not used in some if there is a
single INET hop.  Can you add a sentence about that?

Section 5 says: "...tunnels packets directly between Proxys ...".
Are these IPsec tunnels?  I am trying to fully understand when the
tunnels require IPsec (or some other security protocol) and when they
do not.

Section 10 lists IPsec, TLS, WireGuard, etc.  This is the first
reference to TLS.  When do you see TLS being used?