Re: [secdir] SECDIR review of draft-ietf- bess-evpn-usage-07

["Rabadan, Jorge (Nokia - US/Mountain View)" <[e-mail]>]

Kent,

Thank you very much for your comments.
I have fixed the grammar errors, added PE to the terminology section and added this to the security section:

“The procedures described in this document are a subset of the procedures in [RFC7432] and thus no new security concerns arise.”


Alvaro, I assume we don’t need to post a new version and it can wait till the next reviews, right?

Thank you.
Jorge

From: Stephen Kent <[e-mail]>
Date: Friday, February 2, 2018 at 11:06 PM
To: Alvaro Retana <[e-mail]>, "Henderickx, Wim (Nokia - BE/Antwerp)" <[e-mail]>, "[e-mail]" <[e-mail]>, "[e-mail]" <[e-mail]>, "Rabadan, Jorge (Nokia - US/Mountain View)" <[e-mail]>, "[e-mail]" <[e-mail]>, "Vigoureux, Martin (Nokia - FR/Paris-Saclay)" <[e-mail]>, "[e-mail]" <[e-mail]>, "Palislamovic, Senad (Nokia - US)" <[e-mail]>
Subject: Re: SECDIR review of draft-ietf- bess-evpn-usage-07

Alvaro,
On February 2, 2018 at 1:16:28 PM, Stephen Kent ([e-mail]<mailto:[e-mail]>) wrote:

Steve:

Hi!  How are you?
I'm well. Thanks for asking.


...
Section 10 (Security Considerations) consists of only one sentence, which refers to the corresponding discussion in RFC 7432. Additional text should be provided here to explain why this document does not add any new security considerations. Presumably the rationale is that the provisioning model and initialization procedures described here are a subset of the more general discussion in 7432 and thus no new security concerns arise as a result of this more detailed information. I am not in a position to judge whether that potential rationale is true.

Fair enough.
Good.

I reviewed the Security Considerations section of RFC 7432. It contains about 1.5 pages of text. The first paragraph there cites security considerations text in RFCs 4761, 4762, and 4364 and the text there is generally well-written. However, there is a significant omission, one that should have been noted in the SECDIR review of that document. Specifically, 7432 cites NONE of the BGP security RFCs produced by the SIDR WG (e.g., RFCs 6480-93 et al), even though they preceded publication of that RFC. Since those documents represented the latest proposals for improving BGP security at the time, they ought to have been cited and a very brief discussion of their relevance to EVPN BGP MPLS deployments. I suggest that this document rectify this omission, i.e., cite several of the BGP secure origin authentication RFCs, and the recent BGPSec RFCs (8205-11), and note the relevance of those standards to EVPN BGP MPLS deployments.

The work from sidr doesn’t directly apply to EVPN simply because the ROAs and BGPSec have been specified only for IPv4/IPv6 and not for the Address Family used by EVPN.

Maybe a statement like that is what you’re looking for — but I don’t think it is appropriate to go any further in this document.
A statement explaining why AS origin authentication and BGPSec are not relevant would address my concerns.

Thanks,

Stevce