Re: [secdir] secdir review of draft-ietf-l2vpn-pbb-evpn-09 (resend)

[Kathleen Moriarty <[e-mail]>]

Thanks, Adrian for resending and Catherine for the helpful review.

On Wed, Jan 21, 2015 at 5:38 AM, Adrian Farrel <[e-mail]> wrote:
> Again, re-sending with fixed subject line for people who auto-file.
>
>
>
>
>
> From: iesg [mailto:[e-mail]] On Behalf Of Catherine Meadows
> Sent: 20 January 2015 21:49
> To: [e-mail]; [e-mail];
> [e-mail]
> Cc: Catherine Meadows
> Subject: secdir review of draft-ietf-12vpn-pbb-evpn-09 (resend)
>
>
>
> I messed up the authors’ address when I sent this review last week, so I’m
>
> trying again.
>
>
>
> Cathy
>
>
>
> I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the
> IESG.  These comments were written primarily for the benefit of the
> security area directors.  Document editors and WG chairs should treat
> these comments just like any other last call comments.
>
> This draft describes a method for integrating Ethernet Provider Backbone
> Bridge (PBB) with Ethernet VPN (EVPN) to
> improve the delivery of MAC addresses, in particular with respect to
> scalability.
>
> I don’t see any security concerns with this draft, but I do have some
> comments on the Security Considerations section.
> It is very short, and all it says that the security considerations in the
> EVPN draft apply directly to this draft. I assume that
> it is also the case that this draft introduces no new security
> considerations.  If so, you should say so, and you should
> also say why.  Also, I was wondering if the mechanisms introduced in this
> draft, by introducing a greater degree of organization
> in the delivery of MAC addresses, makes it easier to detect duplicated MACs,
> which were mentioned as a security risk in the
> Security Considerations of the EVPN draft.  If this is the case, it would be
> a good thing to mention here.

Keying off of Adrian's question in his discuss, I think what Catherine
is asking here (please correct me if I am wrong), is to know if the
risk in the EVPN draft of duplicated MACs is mitigated with this draft
since MACs are aggregated (better organized and duplicates removed).
If so, should that be mentioned?  The solution advantages section
(10.1, 10.2, and 10.3 specifically) talks about the aggregation, but
is there a security advantage too?  10.5 sounds as if you might get
more granularity for forwarding policies as well.

>
> I’d consider the draft somewhere between ready with nits and ready with
> issues.  I don’t see any real security issues
> here, just a Security Considerations section that needs to be expanded a
> little, but this seems to be a little more than what the
> secdir guidelines would call a nit.

If none of those apply and change anything from the referenced
section, the simple statement that no additional security
considerations are added could be helpful.

Thank you,
Kathleen


>
>
>
> Catherine Meadows
> Naval Research Laboratory
> Code 5543
> 4555 Overlook Ave., S.W.
> Washington DC, 20375
> phone: [phone]
> fax: [phone]
> email: [e-mail]
>
>



-- 

Best regards,
Kathleen