Re: [secdir] [Last-Call] Secdir last call review of draft-ietf-opsawg-l3sm-l3nm-10

[tom petch <[e-mail]>]

On 25/07/2021 21:54, Rifaat Shekh-Yusef via Datatracker wrote:
> Reviewer: Rifaat Shekh-Yusef
> Review result: Has Issues
>
> I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the
> IESG.  These comments were written primarily for the benefit of the
> security area directors.  Document editors and WG chairs should treat
> these comments just like any other last call comments.
>
> This document defines an L3VPN Network YANG Model (L3NM) that can be
> used for the provisioning of Layer 3 Virtual Private Network (VPN)
> services within a service provider network.  The model provides a
> network-centric view of L3VPN services.
>
> Issues:
>
> 1. The following is a quote from Security Consideration section:
>      "Several data nodes defined in the L3NM rely upon [RFC8177] for
>       authentication purposes."
>
> I think it would be helpful to elaborate on which nodes need the mechanism
> defined in RFC8177 and why?
>
> 2. The summary bullets:
>
>     o  Malicious clients attempting to delete or modify VPN services.
>
> Why 'create' and 'read' are not part of the risks in this case?

Rifat

Reading this I-D, I wondered what the secdir view is of recommending the 
use of MD5 to secure the session as this I-D does for BGP.  (Such a use 
in NTP did generate a comment).

Tom Petch