Re: [secdir] Review of draft-ietf-sfc-architecture-08

["Joel M. Halpern" <[e-mail]>]

I have no problem if someone wants to add link protection because they 
use someone elses resources as part of their domain.
But that is not SFC's problem, and not something, as far as I can tell, 
for the SFC architecture to address.

We have already had to make clear multiple times to folks that we do not 
expect to require the kind of encryption that you are agreeing we don't 
need to require.  Given that, I am very concerned that we not add words 
which will lead readers to think we are making such a requirement.

Yours,
Joel

On 5/25/15 11:01 PM, Benjamin Kaduk wrote:
> On Sun, 24 May 2015, Carlos Pignataro (cpignata) wrote:
>
>> It is true that this new architecture introduces a model in which there
>> is a more dynamic service application, decoupling it from network
>> topology path; however, there is no administrative domain changes or
>> admin fragmentation. In other words, taking it very concrete, there is
>> no change in expectations regarding for example encryption. The service
>> is potentially applied in another part of the network and a chain can be
>> created dynamically, but all within the same admin domain as before.
>
> As I attemted to say in my secdir review of the sfc-problem-statement
> document
> (http://www.ietf.org/mail-archive/web/secdir/current/msg05351.html), it is
> not clear that being within the same administrative domain excuses one
> from considering whether encryption is necessary.  I seem to recall that,
> e.g., Google is encrypting all inter-datacenter traffic (I don't remember
> about intra-datacenter traffic, though).
>
> I do not think it is realistic to think that one can protect a network at
> the boundary -- there are always ways for sufficiently advanced attackers
> to get in, and some form of defense in depth is needed.  Now, I grant that
> encryption may not always be needed, and it is not the place of SFC to
> insist that encryption always be used, but please do not claim that being
> in a single administrative domain excuses the operator from considering
> whether encryption is necessary.
>
> -Ben Kaduk
>