Re: [secdir] Early SecDir Reviews

["Susan Hares" <[e-mail]>]

Russ:

Thank you for the answers.   NETCONF had asked specifically regarding these
issues. 

On SEC-REQ-09, I2RS WG participants suggested that non-secure transport be
used for publishing telemetry data that was specifically indicated to
non-confidential in the data model.    The configuration of  all aspects of
the I2RS agent from the I2RS client would be done over a secure transport.
The passing of most operational status would be done over a secure
transport.  We even suggested that the data models should clearly annotate
what type of transport the data should be passed over (secure or insecure). 

Where do you think it makes sense to put this type of explanation - near
SEC-REQ-09 or in the security considerations section? 

Sue 

-----Original Message-----
From: Russ Housley [mailto:[e-mail]] 
Sent: Monday, August 24, 2015 3:27 PM
To: Susan Hares
Cc: [e-mail];
[e-mail]; 'Stephen Farrell'; 'Kathleen
Moriarty'; 'IETF SecDir'
Subject: Re: Early SecDir Reviews

Sue:

> 1) Is REQ-8 a security requirement? 
> 
>   o  SEC-REQ-08: Each Identity is associated with one secondary
>      identity during a particular read/write sequence, but the
>      secondary identity may vary during the time a connection between
>      the I2RS client and I2RS agent is active.  The variance of the
>      secondary identity allows the I2rs client to be associated with
>      multiple applications and pass along an identifier for these
>      applications in the secondary identifier.

Yes, if that identity is going to be used to make the access control
decision.

> 2) Is REQ-12 - a security requirement for a protocol?  NETCONF asked 
> this of I2RS.
> 
>   SEC-REQ-12: The I2RS Client and I2RS Agent protocol SHOULD implement
>   mechanisms that mitigate DoS attacks

Yes.  For example, the IKE cookie mechanism is only there to make it much
more expensive the an attacker ti implement DDoS.  They can't fire and
forget.  They need to keep state and hang around for at least 1.5 round
trips.

> 3) Section 2.4.1 - is a description of the what happens when multiple 
> changes occur via multiple messages.
> 
> My understanding from your question is that the implementation of how 
> an I2RS Agent processes the changes (change1, change2, change3) that 
> occur in multiple messages is not a security issue, but a 
> implementation issue.  If so, Please let me know.

There might be some protocol issues to assist keep things atomic, but I
agree it i not a security issue.

> 4) Are you Ok with REQ-09 specifying a non-secure transport as an option? 

The security considerations need to be clear what the consequences are if
this option is selected.

Russ