Re: [secdir] sec-dir review of draft-ietf-forces-lfb-lib-10.txt

[Joel Halpern <[e-mail]>]

Would a pointer to 5810 (the ForCES Protocol RFC, which defines how these things are manipulated) help?
The LFBs here are not different from any other LFBs which affect device behavior.  Yes, manipulating them can cause problems.  That's why the protocol has security mechanisms.
(I probably should have caught that and made sure there was such a reference.)
Do we need more than that?

Yours,
Joel

 -----Original Message-----
> From: Derek Atkins [mailto:[e-mail]] 
> Sent: Thursday, January 31, 2013 5:04 PM
> To: [e-mail]; [e-mail]
> Cc: [e-mail]; [e-mail]; 
> [e-mail]; [e-mail]; 
> [e-mail]; Joel Halpern
> Subject: sec-dir review of draft-ietf-forces-lfb-lib-10.txt
> 
> Hi,
> 
> I have reviewed this document as part of the security 
> directorate's ongoing effort to review all IETF documents 
> being processed by the IESG.  These comments were written 
> primarily for the benefit of the security area directors.  
> Document editors and WG chairs should treat these comments 
> just like any other last call comments.
> 
>    This document defines basic classes of Logical Function 
> Blocks (LFBs)
>    used in the Forwarding and Control Element Separation 
> (ForCES).  The
>    basic LFB classes are defined according to ForCES FE model 
> and ForCES
>    protocol specifications, and are scoped to meet requirements of
>    typical router functions and considered as the basic LFB 
> library for
>    ForCES.  The library includes the descriptions of the LFBs and the
>    XML definitions.
> 
> The Security Considerations section offloads itself to RFC3746.
> 
> It is unclear to me if any of the new functions defined in 
> the LFB need any additional authentication or authorization, 
> and if so I do not see how that would be added.
> 
> -derek
> 
> -- 
>        Derek Atkins                 617-623-3745
>        [e-mail]             www.ihtfp.com
>        Computer and Internet Security Consultant
>