IETF Logo Mail Archive

Re: [secdir] SecDir review of draft-ietf-manet-dlep

"Paul Hoffman" <paul.hoffman@vpnc.org> Tue, 22 November 2016 15:46 UTC

Return-Path: <paul.hoffman@vpnc.org>
X-Original-To: secdir@ietfa.amsl.com
Delivered-To: secdir@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1D2241294F5; Tue, 22 Nov 2016 07:46:14 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level:
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WbtUU7SqlT-y; Tue, 22 Nov 2016 07:46:13 -0800 (PST)
Received: from mail.proper.com (Opus1.Proper.COM [207.182.41.91]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 156D412956A; Tue, 22 Nov 2016 07:46:13 -0800 (PST)
Received: from [10.32.60.73] (50-1-51-163.dsl.dynamic.fusionbroadband.com [50.1.51.163]) (authenticated bits=0) by mail.proper.com (8.15.2/8.14.9) with ESMTPSA id uAMFjq3X077810 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Tue, 22 Nov 2016 08:45:53 -0700 (MST) (envelope-from paul.hoffman@vpnc.org)
X-Authentication-Warning: mail.proper.com: Host 50-1-51-163.dsl.dynamic.fusionbroadband.com [50.1.51.163] claimed to be [10.32.60.73]
From: Paul Hoffman <paul.hoffman@vpnc.org>
To: "Taylor, Rick" <rick.taylor.external@airbus.com>
Date: Tue, 22 Nov 2016 07:46:05 -0800
Message-ID: <0AE7C2DE-B316-4675-B7BE-EB9AC50ED955@vpnc.org>
In-Reply-To: <B177F831FB91F242972D0C35F6A0733163AD92C3@SUCNPTEXM01.com.ad.uk.ds.corp>
References: <30706_1479279750_582C0485_30706_8297_7_C7F1D029-C067-4AF6-9F40-436F7BA54311@vpnc.org> <B177F831FB91F242972D0C35F6A0733163AD92C3@SUCNPTEXM01.com.ad.uk.ds.corp>
MIME-Version: 1.0
Content-Type: text/plain; format="flowed"
X-Mailer: MailMate (1.9.5r5263)
Cc: secdir <secdir@ietf.org>, "draft-ietf-manet-dlep.all@ietf.org" <draft-ietf-manet-dlep.all@ietf.org>
Subject: Re: [secdir] SecDir review of draft-ietf-manet-dlep
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/secdir/>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 22 Nov 2016 15:46:14 -0000

On 22 Nov 2016, at 3:34, Taylor, Rick (External) wrote:

> Thank you for the review.  A couple of quick comments:
>
> Did you review draft-ietf-manet-dlep-15 or draft-ietf-manet-dlep-25 
> (the latest)?  As we have attempted to address the security comments 
> raised by the WG and AD review.

I reviewed -25; sorry for the typo in my report.

> One area we have worked hard on addressing is mandating use of RFC5082 
> (Generalized TTL Security) on the link between router and modem (See 
> Section 3.1).  As you correctly state, DLEP does not have any inherent 
> security mechanisms, and recommends link-layer security, such as 
> 802.1X/AE, but we do mandate mechanisms to restrict the protocol to 
> run over a single hop.  As you point out, DLEP is a control-plane 
> protocol and does not carry any user data.

Noted. However, requiring TTL security doesn't prevent snooping or MITM 
attacks.

--Paul Hoffman

v2.46.0 | Report a Bug | By Email | System Status