Re: [secdir] Secdir review of [e-mail]

["Haleplidis Evangelos" <[e-mail]>]

Greetings Magnus,

 

Having discussed the issue with Joel, in order to clarify the text you pointed out, we opted to replace the problematic sentence from:

“However as parallezation tasks have security issues, a designer or an implementer must take into account any security considerations that regards packet parallelization.”

To:

“This document does not attempt to analyze the presence or possibility of security interactions created by allowing parallel operations on packets.  Any such issues, if they exist, are for the designers of the particular data path, not the general mechanism.”

 

This way, we clearly state (the previous sentence didn’t manage to convey that meaning) that security considerations are for implementers and not for the general mechanisms we specify in the draft.

 

Does this resolve your comment?

 

Regards,

Evangelos.

 

From: Magnus Nyström [mailto:[e-mail]] 
Sent: Tuesday, September 30, 2014 9:26 AM
To: [e-mail]; [e-mail]
Subject: Secdir review of [e-mail]

 

 

 

I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments.

 

This document describes how ForCES can model a network device's parallelization datapath to support parallel packet processing in the ForCES model. The document is intended to be published as an Experimental RFC.

 

Since the document does not change the ForCES model or the ForCES protocol, I agree with the Security Consideration section's statement that there's no impact on the security considerations for them. However, the document then goes on to state "However as parallezation [sic] tasks have security issues, a designer or an implementer must take into account any security considerations that regards packet parallelization." I don't know specifically what such security issues are in the context of parallel ForCES packet processing, and it seems that it would be good to include at least some example of them and how implementers should take them into account.


-- Magnus