Re: [secdir] Review of draft-ietf-bfd-vxlan-09

[Jeffrey Haas <[e-mail]>]

Shawn,

On Mon, Dec 09, 2019 at 05:51:30PM -0700, Shawn M. Emery wrote:
> Reviewer: Shawn M. Emery
> Review result: Ready with nits

[...]

> 1. Relating to privacy:
> I believe that this section [security considerations] should also document
> the security impact of deploying BFD on VXLANs for monitoring tunnel
> traffic.
> Which additional information, if any, can now be obtained with BFD usage?

BFD protects transport between two systems and, in the profile envisaged in
this document, does not typically involve itself in protecting user-managed
endpoints.  (In such circumstances, they might consider standard RFC
5880/5881 BFD as a user-provisioned mechanism.)

The traffic for this mechanism is thus between two systems at the tunnel
level and only covers the information necessary to permit the BFD protocol
to execute, including any BFD security mechanisms that may be applied to
that session.  There are thus no end user privacy considerations for this
mechanism.

> 2. Editorial:
> Echo BFD is out of scope for the document, but does not describe the
> reason for this or why state this at all?

This is covered by RFC 5880 section 5.  Similar to most other IETF
documents, when documenting extensions and we do not conflict with the base
behavior, we don't try to copy and paste the motivations as it waters down
the normative text.  (If we were IEEE, we'd reissue the entire suite every
time we touched something...)

Our preference is to leave it alone.

At best, we could say "See RFC 5880, section 5."

-- Jeff