Re: [secdir] Review of draft-ietf-opsec-routing-protocols-crypto-issues-04
"Bhatia, Manav (Manav)" <manav.bhatia@alcatel-lucent.com> Fri, 28 May 2010 23:38 UTC
Return-Path: <manav.bhatia@alcatel-lucent.com>
X-Original-To: secdir@core3.amsl.com
Delivered-To: secdir@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8B3663A6A60 for <secdir@core3.amsl.com>; Fri, 28 May 2010 16:38:20 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 0.208
X-Spam-Level:
X-Spam-Status: No, score=0.208 tagged_above=-999 required=5 tests=[AWL=-0.207, BAYES_40=-0.185, J_CHICKENPOX_83=0.6]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eyu55V2wJYr7 for <secdir@core3.amsl.com>; Fri, 28 May 2010 16:38:19 -0700 (PDT)
Received: from ihemail1.lucent.com (ihemail1.lucent.com [135.245.0.33]) by core3.amsl.com (Postfix) with ESMTP id A32C23A6961 for <secdir@ietf.org>; Fri, 28 May 2010 16:38:19 -0700 (PDT)
Received: from inbansmailrelay2.in.alcatel-lucent.com (h135-250-11-33.lucent.com [135.250.11.33]) by ihemail1.lucent.com (8.13.8/IER-o) with ESMTP id o4SNc2Bn020031 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL); Fri, 28 May 2010 18:38:04 -0500 (CDT)
Received: from INBANSXCHHUB02.in.alcatel-lucent.com (inbansxchhub02.in.alcatel-lucent.com [135.250.12.35]) by inbansmailrelay2.in.alcatel-lucent.com (8.14.3/8.14.3/GMO) with ESMTP id o4SNbwAG029963 (version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=NOT); Sat, 29 May 2010 05:07:59 +0530
Received: from INBANSXCHMBSA1.in.alcatel-lucent.com ([135.250.12.59]) by INBANSXCHHUB02.in.alcatel-lucent.com ([135.250.12.35]) with mapi; Sat, 29 May 2010 05:07:58 +0530
From: "Bhatia, Manav (Manav)" <manav.bhatia@alcatel-lucent.com>
To: Sam Hartman <hartmans-ietf@mit.edu>
Date: Sat, 29 May 2010 05:07:56 +0530
Thread-Topic: [secdir] Review of draft-ietf-opsec-routing-protocols-crypto-issues-04
Thread-Index: Acr+alerd9AWMW+EScaXLmAYdfvDsQAVAt6Q
Message-ID: <7C362EEF9C7896468B36C9B79200D8350CCEB21B3E@INBANSXCHMBSA1.in.alcatel-lucent.com>
References: <20100520172310.GQ9605@oracle.com> <tsl632918s3.fsf@mit.edu> <7C362EEF9C7896468B36C9B79200D8350CCEB21839@INBANSXCHMBSA1.in.alcatel-lucent.com> <tsl7hmozwzn.fsf@mit.edu> <tsl1vcwxibu.fsf@mit.edu>
In-Reply-To: <tsl1vcwxibu.fsf@mit.edu>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
acceptlanguage: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-Scanned-By: MIMEDefang 2.57 on 135.245.2.33
X-Scanned-By: MIMEDefang 2.64 on 135.250.11.33
X-Mailman-Approved-At: Mon, 31 May 2010 08:13:49 -0700
Cc: "jjaeggli@checkpoint.com" <jjaeggli@checkpoint.com>, "shares@nexthop.com" <shares@nexthop.com>, "vishwas@ipinfusion.com" <vishwas@ipinfusion.com>, "secdir@ietf.org" <secdir@ietf.org>
Subject: Re: [secdir] Review of draft-ietf-opsec-routing-protocols-crypto-issues-04
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/secdir>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 28 May 2010 23:38:20 -0000
I am aware of some implementations that look at the IP header to determine the source. I think it's a very good catch and we could append the following before the original text: "In some OSPF implementations neighbors on broadcast .. " Does this sound acceptable? Cheers, Manav > -----Original Message----- > From: Sam Hartman [mailto:hartmans-ietf@mit.edu] > Sent: Friday, May 28, 2010 7.03 PM > To: Sam Hartman > Cc: Bhatia, Manav (Manav); vishwas@ipinfusion.com; > secdir@ietf.org; shares@nexthop.com; jjaeggli@checkpoint.com > Subject: Re: [secdir] Review of > draft-ietf-opsec-routing-protocols-crypto-issues-04 > > Hi. I was attempting to reconcile this draft against > draft-ietf-rpsec-ospf-vuln, an old draft on OSPF vulnerabilities. > Section 4.2.2.4 of the rpsec draft disagrees with the last > paragraph of > section 2 of the opsec draft. That paragraph talks about the > attack in > which the IP address of a hello packet is replayed in order to cause a > node to think that a connection is not bidirectional. The rpsec draft > argues that attack doesn't work because the router ID, not the source > address is used. The rpsec draft also kind of implies this may depend > on implementations. > > I'm not sure which draft is right. However, since there has been > argument about whether this attack is possible,the opsec > draft needs to > either acknowledge or resolve this issue. (Obviously, I'd prefer that > you resolve the issue: it makes our lives easier in karp, but if you > don't have time, I understand just describing it.) > > In particular, I believe the opsec draft should cite as an informative > reference section 4.2.4 of draft-ietf-rpsec-ospf-vuln > 9 > aand do one of the following: > > * Agree with the conclusions > > * State it is an implementation matter whether a particular > implementation is vulnerable > > * Explain why the rpsec draft is wrong > > * Note that the issue is open > > Thanks, > > --Sam >
- [secdir] Review of draft-ietf-opsec-routing-proto… Nicolas Williams
- Re: [secdir] Review of draft-ietf-opsec-routing-p… Sam Hartman
- Re: [secdir] Review of draft-ietf-opsec-routing-p… Sandra Murphy
- Re: [secdir] Review of draft-ietf-opsec-routing-p… Nicolas Williams
- Re: [secdir] Review of draft-ietf-opsec-routing-p… Sandra Murphy
- Re: [secdir] Review of draft-ietf-opsec-routing-p… Sandra Murphy
- Re: [secdir] Review of draft-ietf-opsec-routing-p… Nicolas Williams
- Re: [secdir] Review of draft-ietf-opsec-routing-p… Sam Hartman
- Re: [secdir] Review of draft-ietf-opsec-routing-p… Sam Hartman
- Re: [secdir] Review of draft-ietf-opsec-routing-p… Sam Hartman
- Re: [secdir] Review of draft-ietf-opsec-routing-p… Sandra Murphy
- Re: [secdir] Review of draft-ietf-opsec-routing-p… Sam Hartman
- Re: [secdir] Review of draft-ietf-opsec-routing-p… Sam Hartman
- Re: [secdir] Review of draft-ietf-opsec-routing-p… Bhatia, Manav (Manav)
- Re: [secdir] Review of draft-ietf-opsec-routing-p… Bhatia, Manav (Manav)
- Re: [secdir] Review of draft-ietf-opsec-routing-p… Bhatia, Manav (Manav)