Re: [secdir] SECDIR review of draft-ietf- bess-evpn-usage-07

[Stephen Kent <[e-mail]>]

Alvaro,
> On February 2, 2018 at 1:16:28 PM, Stephen Kent ([e-mail] 
> <mailto:[e-mail]>) wrote:
>
> Steve:
>
> Hi!  How are you?
I'm well. Thanks for asking.
>
> ...
>>
>> Section 10 (Security Considerations) consists of only one sentence, 
>> which refers to the corresponding discussion in RFC 7432. Additional 
>> text should be provided here to explain why this document does not 
>> add any new security considerations. Presumably the rationale is that 
>> the provisioning model and initialization procedures described here 
>> are a subset of the more general discussion in 7432 and thus no new 
>> security concerns arise as a result of this more detailed 
>> information. I am not in a position to judge whether that potential 
>> rationale is true.
>>
> Fair enough.
>
Good.
>>
>> I reviewed the Security Considerations section of RFC 7432. It 
>> contains about 1.5 pages of text. The first paragraph there cites 
>> security considerations text in RFCs 4761, 4762, and 4364 and the 
>> text there is generally well-written. However, there is a significant 
>> omission, one that should have been noted in the SECDIR review of 
>> that document. Specifically, 7432 cites NONE of the BGP security RFCs 
>> produced by the SIDR WG (e.g., RFCs 6480-93 et al), even though they 
>> preceded publication of that RFC. Since those documents represented 
>> the latest proposals for improving BGP security at the time, they 
>> ought to have been cited and a very brief discussion of their 
>> relevance to EVPN BGP MPLS deployments. I suggest that this document 
>> rectify this omission, i.e., cite several of the BGP secure origin 
>> authentication RFCs, and the recent BGPSec RFCs (8205-11), and note 
>> the relevance of those standards to EVPN BGP MPLS deployments.
>>
> The work from sidr doesn’t directly apply to EVPN simply because the 
> ROAs and BGPSec have been specified only for IPv4/IPv6 and not for the 
> Address Family used by EVPN.
>
> Maybe a statement like that is what you’re looking for — but I don’t 
> think it is appropriate to go any further in this document.
>
A statement explaining why AS origin authentication and BGPSec are not 
relevant would address my concerns.

Thanks,

Stevce