Re: [secdir] SecDir review of draft-ietf-pce-gmpls-aps-req-08

["Ogaki, Kenichi" <[e-mail]>]

Dear Yaron an Adrian,

Thank you for your comments.

To address your comments, we propose the texts for Sec. 4. Security
Considerations as follows:

PCEP extensions to support GMPLS should be considered under the same
security as current PCE work and this extension will not change the
underlying security issues. Sec. 10 of [RFC5440] describes the list of
security considerations in PCEP. At the time [RFC5440] was published, TCP
Authentication Option (TCP-AO) had not been fully specified for securing the
TCP connections that underlie PCEP sessions. TCP-AO [RFC5925] has now been
published and PCEP implementations should fully support TCP-AO according to
[RFC6952].

Thanks,
Kenichi

--
Kenichi Ogaki
KDDI | IP Transport Network Development Dept.
[phone] | www.kddi.com

> -----Original Message-----
> From: Adrian Farrel [mailto:[e-mail]]
> Sent: Monday, June 17, 2013 5:14 AM
> To: 'Yaron Sheffer'
> Cc: 'IETF Security Directorate'; 'The IESG';
> [e-mail]
> Subject: RE: SecDir review of draft-ietf-pce-gmpls-aps-req-08
> 
> Hi,
> 
> Thanks Yaron.
> 
> You're right about pointing to 5440. That document notes that TCP-AO
should
> be used once it becomes available, and since it has done, a pointer to RFC
> 6952 would also be helpful.
> 
> Cheers,
> Adrian
> 
> > -----Original Message-----
> > From: [e-mail] [mailto:[e-mail]] On Behalf
> > Of Yaron Sheffer
> > Sent: 16 June 2013 21:11
> > To: IETF Security Directorate; The IESG; draft-ietf-pce-gmpls-aps-
> > [e-mail]
> > Subject: SecDir review of draft-ietf-pce-gmpls-aps-req-08
> >
> > I have reviewed this document as part of the security directorate's
> > ongoing effort to review all IETF documents being processed by the IESG.
> > These comments were written primarily for the benefit of the security
> > area directors.  Document editors and WG chairs should treat these
> > comments just like any other last call comments.
> >
> > This document defines additional GMPLS-specific requirements on the
> > PCE architecture.
> >
> > It would be an understatement to characterize this reviewer as a
> > non-expert on PCE and GMPLS. That being said, I believe the Security
> > Considerations are correct in saying that this document does not add
> > any additional security issues on top of PCE.
> >
> > I would recommend to add a pointer to where such considerations are in
> > fact listed, e.g. Sec. 10 of RFC 5440. Though security folks will
> > cringe at TCP-MD5 being described as the most practical security
> > solution in that section.
> >
> > Thanks,
> > 	Yaron