Re: [secdir] New Routing Area Security Design Team

Yeah, the elephant problem is part of why I was asking about deliverables
-- it seems like even having the discussion could help us assemble a more
complete picture of the elephant.

I appreciate that "Security Considerations for X" can be a tempting target,
but I honestly wonder whether they're worthwhile.  Writing a guide to BGP
that pounds its shoe on the table and says "DO BGPSEC!" is not going to
substantively move the needle, just like all our shouting about IPsec and
DNSSEC has been basically for nought.

It would be good to avoid all the spinning of wheels that has been done in
those domains in the cases where we're looking to improve routing
security.  FWIW, HTTPS is the one domain where there has been some real
progress toward universal security.  I would be glad to compare notes on
what worked there, and see if we can translate anything to the routing
domain.

I wonder if it would be useful to start by evaluating what change needs to
be made in the Internet.  Which part of the elephant is the bleeding the
worst?  What are the risks that are causing the most harm today, which we
should put the most effort into fixing?

On Fri, Apr 13, 2018 at 5:25 PM, Acee Lindem (acee) <acee@cisco.com> wrote:

> Hi Richard,
>
> When you talk about Routing Security, it is like the blind men and
> elephant, everyone has a different opinion on what the priorities are. From
> my viewpoint (and I do have one bad eye ;^), one of the outcomes should be
> finding the right set of authors for protocol specific “XXXX Security
> Considerations” documents where XXXX is BGP, IS-IS, OSPF, LDP, PIM, etc.
> Additionally, we’d provide a generic outline for these documents.
>
> Thanks,
> Acee
>
> From: Richard Barnes <rlb@ipv.sx>
> Date: Friday, April 13, 2018 at 4:21 PM
> To: Deborah Brungard <db3546@att.com>
> Cc: "secdir@ietf.org" <secdir@ietf.org>, Russ White <russ@riw.us>, Jeff
> Haas <jhaas@pfrc.org>, Stewart Bryant <stewart.bryant@gmail.com>, Acee
> Lindem <acee@cisco.com>
> Subject: Re: [secdir] New Routing Area Security Design Team
>
> (trimming the CC list a bit)
>
> Hey Deborah,
>
> Delighted to hear this news.  Do you have an idea of what the initial
> deliverables are for this group?  What security problems are they going to
> try to address?
>
> TBH, it seems like the headline problem at the Internet level is BGP
> abuse.  The base RPKI docs have been out for several years now, and BGPSEC
> is pretty much finished, but the deployment numbers continue to hover
> around 8-9% for even the most basic protections.  It would be delightful to
> have a group take a look at what the deployment blockers are here, and
> whether there's anything the IETF could do to help, whether it's updating
> protocols, producing deployment guides, writing code, etc.  We shouldn't
> think that RFCs are the only tool in our arsenal.
>
> Thanks,
> --Richard
>
> [1] https://rpki-monitor.antd.nist.gov/
>
>
> On Fri, Apr 13, 2018 at 4:11 PM, BRUNGARD, DEBORAH A <mailto:
> db3546@att.com> wrote:
> The Routing ADs have chartered a design team as described below.
>
> I will be the AD-contact: mailto:db3546@att.com
>
> Routing Area Security Design Team Charter
>
> Internet security threats have evolved in the last couple of years and
> questions are arising about the security properties of many long-standing
> IETF routing protocols and new protocols under development. This is an
> opportunity for the Routing Area to evaluate current assumptions and make
> recommendations for new work.
>
> The Routing Area will kick off a Routing Area-wide Design team with
> support from the OPS Area and Security Area. The first phase will consist
> of a small team:
>
> Stewart Bryant mailto:stewart.bryant@gmail.com
> Jeff Haas mailto:jhaas@pfrc.org
> Acee Lindem mailto:acee@cisco.com
> Russ White mailto:russ@riw.us
>
> They will be responsible to set up an environment (e..g. wiki), identify
> work items, and coordinating overall the work effort. It is the expectation
> this initial phase will be done by May 1. A second phase will consist of
> small teams working on targeted items. Work items will include review of
> current deployments (use models) and threat models, evaluation criteria and
> useful advice when doing new work (on existing protocols and new
> protocols), and recommendations on where new work is needed in cooperation
> with the responsible working group. The work will have support from the
> Security Area and OPS Area.
>
> The design team will have a private mailing list for this first phase and
> can be reached at mailto:rt-dt-security@ietf.org.
>
> Regards,
> Deborah
>
>
>
> _______________________________________________
> secdir mailing list
> mailto:secdir@ietf.org
> https://www.ietf.org/mailman/listinfo/secdir
> wiki: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview
>
>
>