Re: [secdir] Secdir review of draft-ietf-isis-pcr

[János Farkas <[e-mail]>]

Hi Rich,

Thank you very much for your review!
Please find response to your questions in-line.

On 1/7/2016 3:31 PM, Salz, Rich wrote:
> I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written primarily for the benefit of the security area directors.  Document editors and WG chairs should treat these comments just like any other last call comments.
>
> My view: Ready with issues, about the security considerations section.
>
> I know very little about IS-IS, or even the overall routing discipline.
>
> One nit is that this document cannot easily be read stand-alone.  That is probably okay, but a pointer to background RFC's are a definition of terms (e.g., sub-TLV) would be helpful.
This document largely relies on the following IS-IS specifications: 
RFC6329 (IS-IS Extensions Supporting IEEE 802.1aq Shortest Path 
Bridging), RFC5305 (IS-IS Extensions for Traffic Engineering) and 
ietf-isis-te-metric-extensions, which are all normative references. 
Further pointers are given to the corresponding IEEE 802.1 
specifications, which explain the use of the IS-IS sub-TLVs.
We can give further references if there is anything in particular that 
is not clear.

>
> I do not understand how "reserving capacity" or "specifying capacity" cannot be used as a denial of service attack.  Perhaps that is related to the above paragraph?
Yes, this is pointed out in the penultimate paragraph of the security 
considerations. IS-IS PCR follows the PCE architecture specified by 
RFC4655. Therefore, the security considerations of RFC4655 are 
applicable here too, which I believe is stated in this paragraph.

> Is there authentication (perhaps out of band) between IS-IS systems?  Message integrity that prevents spoofing or modification?
Yes, security solutions are available for IS-IS.
The last paragraph of security considerations is intended to describe 
this. It first explains that IS-IS security considerations apply as 
IS-IS PCR is based on IS-IS. Furthermore, this paragraph also points out 
that the existing IS-IS security solutions are applicable for IS-IS PDUs 
between PCE and IS-IS System and among IS-IS Systems. This paragraph 
refers to RFC5310 (IS-IS Generic Cryptographic Authentication), which 
refers further to RFC 5304 (IS-IS Cryptographic Authentication); which 
can be used for IS-IS PCR.

We can make updates to the text if you find anything missing. Please let 
us know.

Regards,
Janos