Re: [secdir] Secdir review of draft-ietf-sidr-bgpsec-threats-06

[Stephen Kent <[e-mail]>]

Joe,

>    Some issues:
>
> 1.   I found it difficult to link the threats in section 3 to the attacks in section 4.   This is more of a consistency of terminology issue and is probably just a nit.
There is not  1-to-1 correspondence between threats and attacks. So, for 
each attacks in
Section 4, there may be more than one threat that is motivated and 
capable of effecting
the attack.
> 2.   The attacks in sections 4.1, 4.2, and 4.3 seem to be largely discounted as out of scope, yet they seem to impact the goals of PATHSEC.   Is it assumed that there are countermeasures in place such as link protection between RGP peers?    If other countermeasures besides PATHSEC are expected to be in place this should probably be mentioned in the security considerations.
The text in 4.1, 4.2, and 4.3 does not say that those attacks are out of 
scope. In 4.1,
there is little text because the attacks are not specific to the 
RPKI/PATHSEC context.
Countermeasures are generic for IP and TCP layer attacks, as noted in 
the requirements
doc. In 4.2 and 4.3 we give a number of examples of these classes of 
attacks, which
is what this doc is intended to do. (Recall, it is not a requirements doc.)
> 3.   I found the argument against not including 'route leakage' a bit weak since the documents seems to be able to define what it means.   Wouldn't 'route leakage' be a mechanism to realize one or more of the threats in section 3?
There is not yet an accepted definition of route leak that represents a 
violation of BGP
specs. The GROW WG is supposed to look into this issue. If it develops a 
suitable proposal, then IDR may elect to modify the BGP spec to address 
the concern.  If IDR does so, SIDR's charter could be modified to 
develop countermeasures for the concern. But, for now, this is out of 
scope. So I disagree with the comment that the argument is weak. Also, 
your use of the term "threat" in the last sentence above is not 
consistent with the way the term is defined and used in Section 3; you 
seem to have switched "threat" and "attack" as well as section numbers.

Steve