Re: [secdir] SecDir review of draft-ietf-tsvwg-rsvp-l3vpn-02

Magnus Westerlund <magnus.westerlund@ericsson.com> Thu, 03 September 2009 17:48 UTC

Return-Path: <magnus.westerlund@ericsson.com>
X-Original-To: secdir@core3.amsl.com
Delivered-To: secdir@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BEEAD3A6778; Thu, 3 Sep 2009 10:48:45 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.766
X-Spam-Level:
X-Spam-Status: No, score=-5.766 tagged_above=-999 required=5 tests=[AWL=0.483, BAYES_00=-2.599, HELO_EQ_SE=0.35, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yaov2D-6n7vy; Thu, 3 Sep 2009 10:48:44 -0700 (PDT)
Received: from mailgw3.ericsson.se (mailgw3.ericsson.se [193.180.251.60]) by core3.amsl.com (Postfix) with ESMTP id 0633D3A6767; Thu, 3 Sep 2009 10:48:40 -0700 (PDT)
X-AuditID: c1b4fb3c-b7b6eae000001984-0f-4a9f929d286f
Received: from esealmw126.eemea.ericsson.se (Unknown_Domain [153.88.253.125]) by mailgw3.ericsson.se (Symantec Mail Security) with SMTP id 7F.1D.06532.D929F9A4; Thu, 3 Sep 2009 11:55:41 +0200 (CEST)
Received: from esealmw126.eemea.ericsson.se ([153.88.254.174]) by esealmw126.eemea.ericsson.se with Microsoft SMTPSVC(6.0.3790.3959); Thu, 3 Sep 2009 11:55:40 +0200
Received: from [147.214.183.250] ([147.214.183.250]) by esealmw126.eemea.ericsson.se with Microsoft SMTPSVC(6.0.3790.3959); Thu, 3 Sep 2009 11:55:40 +0200
Message-ID: <4A9F929C.9030309@ericsson.com>
Date: Thu, 03 Sep 2009 11:55:40 +0200
From: Magnus Westerlund <magnus.westerlund@ericsson.com>
User-Agent: Thunderbird 2.0.0.23 (Windows/20090812)
MIME-Version: 1.0
To: Francois Le Faucheur IMAP <flefauch@cisco.com>
References: <C666D4B1.2C65%stefan@aaa-sec.com> <A70CE797-56BE-41E2-A618-22A99646681B@cisco.com>
In-Reply-To: <A70CE797-56BE-41E2-A618-22A99646681B@cisco.com>
X-Enigmail-Version: 0.96.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
X-OriginalArrivalTime: 03 Sep 2009 09:55:40.0540 (UTC) FILETIME=[B1E19BC0:01CA2C7C]
X-Brightmail-Tracker: AAAAAA==
Cc: Gorry Fairhurst <gorry@erg.abdn.ac.uk>, Bruce Davie <bsd@cisco.com>, secdir@ietf.org, iesg@ietf.org, Ashok Narayanan <ashokn@cisco.com>, James Polk <jmpolk@cisco.com>
Subject: Re: [secdir] SecDir review of draft-ietf-tsvwg-rsvp-l3vpn-02
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/secdir>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 03 Sep 2009 17:48:45 -0000

Hi,

I haven't seen any follow up on this discussion. Can Stefan and Francois
please come to conlusion on what to do?

Cheers

Magnus

Francois Le Faucheur IMAP skrev:
> Hello Stefan,
> 
> Thanks for your review. Please find a response to your question embedded
> below:
> 
> On 23 Jun 2009, at 18:51, Stefan Santesson wrote:
> 
>> I have reviewed this document as part of the security directorate's
>> ongoing effort to review all IETF documents being processed by the
>> IESG.  These comments were written primarily for the benefit of the
>> security area directors.  Document editors and WG chairs should treat
>> these comments just like any other last call comments.
>>
>> This specification define a set of procedures to overcome challenges
>> with deployment of Resource Reservation Protocols over BGP/MPLS VPNs.
>>
>> The BGP/MPLS VPN (RFC 4364) is a VPN technique that doesn't rely
>> encryption to ensure secrecy or message integrity. The security
>> properties are instead dependent on the security of the network
>> infrastructure.
>>
>> It appears that this draft makes a serious effort to describe and
>> analyze relevant security considerations. With my limited expertise in
>> this particular area I can't find any thing that is obviously missing.
>>
>> However, one question that comes to my mind, which might be worth
>> looking at from a security perspective, is whether the procedures
>> introduced by this document requires the communication to be
>> unencrypted and if so, whether deployment of this protocol blocks or
>> prevents legitimate use of e.g. IPsec based VPN as discussed in RFC
>> 4364 and RFC 4023. If this is the case, should it be discussed in the
>> security considerations section?
> 
> The short answer is that this document does not require that
> communication be un-encrypted.
> 
> The longer answer would be:
> 
> RFC4364 mentions use of IPsec both CE-CE and PE-PE:
> Specifically, I noticed: "Cryptographic privacy is not provided by this
> architecture, nor by Frame Relay or ATM VPNs. These architectures are
> all compatible with the use of cryptography on a CE-CE basis, if that is
> desired. The use of cryptography on a PE-PE basis is for further study."
> 
> Regarding PE-PE IPsec:
> * RSVP over VPN would work just fine (as currently specified) for PE-CE
> links
> * RSVP over VPN would not allow CAC over MPLS Core as we need TE tunnels
> to do that which I believe could not be used with MPLS over IP/IPsec in
> the core.
> 
> Regarding CE-CE IPsec (or if IPsec starts deeper inside the VPN site):
> RFC 4923 "Quality of Service (QoS) Signaling in a Nested Virtual Private
> Network" describes a model for RSVP operation through IPsec Gateways (in
> a nutshell, the idea is that there is effectively a form of hierarchical
> RSVP where an RSVP reservation is made for the IPsec tunnel and then
> individual RSVP reservations are admitted/aggregated over the tunnel
> reservation). This would apply in case to the case of CE-CE IPsec (or if
> IPsec starts deeper inside the VPN site) and the procedures defined in
> the document would simply apply "as is" to the reservation for the
> tunnel(s) (and not to the individual end to end RSVP reservation).
> 
> If this answers your question appropriately, we could add text capturing
> this in the Security Considerations (whenever we issue the next rev).
> Please let us if this works for you.
> 
> Thanks
> 
> Francois
> 
>>
>>
>> *Stefan Santesson
>> *AAA-sec.com
>>
>>
>>
>>
>>
> 


-- 

Magnus Westerlund

IETF Transport Area Director
----------------------------------------------------------------------
Multimedia Technologies, Ericsson Research EAB/TVM
----------------------------------------------------------------------
Ericsson AB                | Phone  +46 10 7148287
Färögatan 6                | Mobile +46 73 0949079
SE-164 80 Stockholm, Sweden| mailto: magnus.westerlund@ericsson.com
----------------------------------------------------------------------