Re: [secdir] Secdir review of draft-ietf-sidr-bgpsec-threats-06

["Joseph Salowey (jsalowey)" <[e-mail]>]

On Sep 30, 2013, at 9:38 AM, Stephen Kent <[e-mail]>
 wrote:

> Joe,
> 
>>   Some issues:
>> 
>> 1.   I found it difficult to link the threats in section 3 to the attacks in section 4.   This is more of a consistency of terminology issue and is probably just a nit.
> There is not  1-to-1 correspondence between threats and attacks. So, for each attacks in
> Section 4, there may be more than one threat that is motivated and capable of effecting
> the attack.

[Joe] OK

>> 2.   The attacks in sections 4.1, 4.2, and 4.3 seem to be largely discounted as out of scope, yet they seem to impact the goals of PATHSEC.   Is it assumed that there are countermeasures in place such as link protection between RGP peers?    If other countermeasures besides PATHSEC are expected to be in place this should probably be mentioned in the security considerations.
> The text in 4.1, 4.2, and 4.3 does not say that those attacks are out of scope. In 4.1,
> there is little text because the attacks are not specific to the RPKI/PATHSEC context.
> Countermeasures are generic for IP and TCP layer attacks, as noted in the requirements
> doc. In 4.2 and 4.3 we give a number of examples of these classes of attacks, which
> is what this doc is intended to do. (Recall, it is not a requirements doc.)

[Joe] OK

>> 3.   I found the argument against not including 'route leakage' a bit weak since the documents seems to be able to define what it means.   Wouldn't 'route leakage' be a mechanism to realize one or more of the threats in section 3?
> There is not yet an accepted definition of route leak that represents a violation of BGP
> specs. The GROW WG is supposed to look into this issue. If it develops a suitable proposal, then IDR may elect to modify the BGP spec to address the concern.  If IDR does so, SIDR's charter could be modified to develop countermeasures for the concern. But, for now, this is out of scope. So I disagree with the comment that the argument is weak. Also, your use of the term "threat" in the last sentence above is not consistent with the way the term is defined and used in Section 3; you seem to have switched "threat" and "attack" as well as section numbers.
> 

[Joe]  As long as the issue is not being dropped then much of my concern is addressed.   If it turns out to be something of concern to BGP then mechanisms can be modified or developed to address it. 

> Steve