Re: [secdir] SECDIR review of draft-ietf-pals-seamless-vccv-02

[Stephen Farrell <[e-mail]>]

Hi all,

On 29/04/16 10:19, Stewart Bryant wrote:
> I think we need to wind this discussion way back.

I agree. I see a couple of things happening in this
discussion that have happened before and will happen
again:

1) a secdir reviewer finds very little in the way of
security mechanism specified for important routing
protocols when trying to understand some minor update
to something

2) the reviewer comments on that saying: "hey, this
whole thing is pretty insecure looking, what's up?
e.g. you could do <badthing-n> here."

3) authors/chairs/WG participants say "it's ok, these
are well managed networks, if you can do <badthing-n>
then there are much worse things you could do" and
maybe over-react a bit as well, fearing that some
security mafia are going to try force them to pretend
to add crypto to loads of stuff

4) n++; goto 2 (a few times;-)

I'm not sure how we break that cycle to be honest,
at least not for we==IETF participants.

I doubt it's likely that we can ensure that secdir
reviewers are all familiar with MPLS, PW, etc etc.
I equally doubt that routing folks will (for both good
and perhaps less good reasons) define, implement
and deploy the kind of security mechanisms that'd
be needed to avoid secdir reviewers being surprised.

I suspect what'll eventually happen is that outside
the IETF context, routing folks and/or their customers
will decide that boundary security is just no longer
good enough by itself and will end up having to do a
load of work to address that. And some bits of that
work will end up being IETF stuff. (One would hope
that all the SDN and similar bits of work are going
to head down that path and not try to depend just on
boundary security for example.)

In the meantime, I think we just repeat the above
loop now and then.

Cheers,
S.