Re: [secdir] Secdir last call review of draft-ietf-bier-oam-requirements-12

[Barry Leiba <[e-mail]>]

Thanks, Greg, for considering my comments; the text you propose is useful.
I can’t attest to its completeness, as routing and OAM aren’t my
expertise.  But it makes it clear that thought was put into this.

Barry

On Wed, Aug 9, 2023 at 6:50 PM Greg Mirsky <[e-mail]> wrote:

> Hi Barry,
> thank you for your comments and suggestions. I agree that even though this
> document lists requirements for BIER OAM, the Security Consideration
> section should be more useful to a reader. Below is the proposed update:
> OLD TEXT:
>    This document lists the OAM requirement for a BIER-enabled domain and
>    does not raise any security concerns or issues in addition to ones
>    common to networking.
> NEW TEXT:
>    This document lists the OAM requirement for a BIER-enabled domain and
>    thus inherits security considerations discussed in [RFC8279] and
>    [RFC8296].  Another general security aspect results from using active
>    OAM protocols, according to the [RFC7799], in a multicast network.
>    Active OAM protocols inject specially constructed test packets, and
>    some active OAM protocols are based on the echo request/reply
>    principle.  In the multicast network, test packets are replicated as
>    data packets, thus creating a possible amplification effect of
>    multiple echo responses being transmitted to the sender of the echo
>    request.  Thus, an implementation of BIER OAM MUST protect the
>    control plane from spoofed replies.  Also, an implementation of BIER
>    OAM MUST provide control of the number of BIER OAM messages sent to
>    the control plane.
>
> What are your thoughts about the new text? I greatly appreciate your
> comments, suggestions, and questions.
>
> Regards,
> Greg
>
> On Wed, Aug 9, 2023 at 12:09 PM Barry Leiba via Datatracker <
> [e-mail]> wrote:
>
>> Reviewer: Barry Leiba
>> Review result: Has Issues
>>
>> The only comment I have from a security standpoint is that the Security
>> Considerations seem basically absent, saying no more than "Nothing to see
>> here."  That's common and easy to say, but I expected some explanation of
>> how
>> the requirements specified in the document are needed to ensure a robust
>> and
>> secure BIER system.  I wouldn't expect pages of text, but I'm surprised
>> to see
>> nothing at all.  Is it really the case that an OAM system for BIER would
>> do
>> nothing to enhance security, nothing to alert us to BIER-specific attacks?
>>
>>
>>