[secdir] Secdir review of draft-ietf-dime-ovli

"Paul Hoffman" <paul.hoffman@vpnc.org> Fri, 24 July 2015 14:30 UTC

Return-Path: <paul.hoffman@vpnc.org>
X-Original-To: secdir@ietfa.amsl.com
Delivered-To: secdir@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 786AF1A1ABF for <secdir@ietfa.amsl.com>; Fri, 24 Jul 2015 07:30:29 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 0.053
X-Spam-Level:
X-Spam-Status: No, score=0.053 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, HELO_MISMATCH_COM=0.553] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 43CCK-JBhS0Z for <secdir@ietfa.amsl.com>; Fri, 24 Jul 2015 07:30:27 -0700 (PDT)
Received: from hoffman.proper.com (Opus1.Proper.COM [207.182.41.91]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 963FD1A1A82 for <secdir@ietf.org>; Fri, 24 Jul 2015 07:30:27 -0700 (PDT)
Received: from [10.47.60.67] (chwl001.hbnet.cz [62.168.35.67] (may be forged)) (authenticated bits=0) by hoffman.proper.com (8.15.1/8.14.9) with ESMTPSA id t6OEUPrk019723 (version=TLSv1 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for <secdir@ietf.org>; Fri, 24 Jul 2015 07:30:26 -0700 (MST) (envelope-from paul.hoffman@vpnc.org)
X-Authentication-Warning: hoffman.proper.com: Host chwl001.hbnet.cz [62.168.35.67] (may be forged) claimed to be [10.47.60.67]
From: "Paul Hoffman" <paul.hoffman@vpnc.org>
To: secdir <secdir@ietf.org>
Date: Fri, 24 Jul 2015 16:30:25 +0200
Message-ID: <F9066F07-294E-4CD4-83C5-C59949D981DF@vpnc.org>
MIME-Version: 1.0
Content-Type: text/plain; format=flowed
X-Mailer: MailMate (1.9.1r5084)
Archived-At: <http://mailarchive.ietf.org/arch/msg/secdir/2cyoWx9QzPm22Xvk0FNUvIEJKCA>
Subject: [secdir] Secdir review of draft-ietf-dime-ovli
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/secdir/>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 24 Jul 2015 14:30:29 -0000

Greetings again. This document, "Diameter Overload Indication 
Conveyance", is a way for a Diameter server in a cluster to tell other 
servers in the cluster "don't send so many requests to me". It is pretty 
complex and fiddly, but seems sensible. The security considerations are 
numerous, but fairly well covered in the extensive Security 
Considerations section.

Note that there is not much that can really be done here to address the 
biggest concern of spoofing. As the document says:

    Diameter does not include features to provide end-to-end
    authentication, integrity protection, or confidentiality.  This may
    cause complications when sending overload reports between non-
    adjacent nodes.

(Nice use of "may" there...) So, there isn't much that can be demanded 
of this document without some obvious controls. Still, the Security 
Considerations section covers the likely attacks and problems.

--Paul Hoffman