Re: [secdir] SecDir review of draft-ietf-tsvwg-rsvp-l3vpn-02

Magnus Westerlund <> Thu, 03 September 2009 17:48 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id BEEAD3A6778; Thu, 3 Sep 2009 10:48:45 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -5.766
X-Spam-Status: No, score=-5.766 tagged_above=-999 required=5 tests=[AWL=0.483, BAYES_00=-2.599, HELO_EQ_SE=0.35, RCVD_IN_DNSWL_MED=-4]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id yaov2D-6n7vy; Thu, 3 Sep 2009 10:48:44 -0700 (PDT)
Received: from ( []) by (Postfix) with ESMTP id 0633D3A6767; Thu, 3 Sep 2009 10:48:40 -0700 (PDT)
X-AuditID: c1b4fb3c-b7b6eae000001984-0f-4a9f929d286f
Received: from (Unknown_Domain []) by (Symantec Mail Security) with SMTP id 7F.1D.06532.D929F9A4; Thu, 3 Sep 2009 11:55:41 +0200 (CEST)
Received: from ([]) by with Microsoft SMTPSVC(6.0.3790.3959); Thu, 3 Sep 2009 11:55:40 +0200
Received: from [] ([]) by with Microsoft SMTPSVC(6.0.3790.3959); Thu, 3 Sep 2009 11:55:40 +0200
Message-ID: <>
Date: Thu, 03 Sep 2009 11:55:40 +0200
From: Magnus Westerlund <>
User-Agent: Thunderbird (Windows/20090812)
MIME-Version: 1.0
To: Francois Le Faucheur IMAP <>
References: <> <>
In-Reply-To: <>
X-Enigmail-Version: 0.96.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
X-OriginalArrivalTime: 03 Sep 2009 09:55:40.0540 (UTC) FILETIME=[B1E19BC0:01CA2C7C]
X-Brightmail-Tracker: AAAAAA==
Cc: Gorry Fairhurst <>, Bruce Davie <>,,, Ashok Narayanan <>, James Polk <>
Subject: Re: [secdir] SecDir review of draft-ietf-tsvwg-rsvp-l3vpn-02
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Security Area Directorate <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Thu, 03 Sep 2009 17:48:45 -0000


I haven't seen any follow up on this discussion. Can Stefan and Francois
please come to conlusion on what to do?



Francois Le Faucheur IMAP skrev:
> Hello Stefan,
> Thanks for your review. Please find a response to your question embedded
> below:
> On 23 Jun 2009, at 18:51, Stefan Santesson wrote:
>> I have reviewed this document as part of the security directorate's
>> ongoing effort to review all IETF documents being processed by the
>> IESG.  These comments were written primarily for the benefit of the
>> security area directors.  Document editors and WG chairs should treat
>> these comments just like any other last call comments.
>> This specification define a set of procedures to overcome challenges
>> with deployment of Resource Reservation Protocols over BGP/MPLS VPNs.
>> The BGP/MPLS VPN (RFC 4364) is a VPN technique that doesn't rely
>> encryption to ensure secrecy or message integrity. The security
>> properties are instead dependent on the security of the network
>> infrastructure.
>> It appears that this draft makes a serious effort to describe and
>> analyze relevant security considerations. With my limited expertise in
>> this particular area I can't find any thing that is obviously missing.
>> However, one question that comes to my mind, which might be worth
>> looking at from a security perspective, is whether the procedures
>> introduced by this document requires the communication to be
>> unencrypted and if so, whether deployment of this protocol blocks or
>> prevents legitimate use of e.g. IPsec based VPN as discussed in RFC
>> 4364 and RFC 4023. If this is the case, should it be discussed in the
>> security considerations section?
> The short answer is that this document does not require that
> communication be un-encrypted.
> The longer answer would be:
> RFC4364 mentions use of IPsec both CE-CE and PE-PE:
> Specifically, I noticed: "Cryptographic privacy is not provided by this
> architecture, nor by Frame Relay or ATM VPNs. These architectures are
> all compatible with the use of cryptography on a CE-CE basis, if that is
> desired. The use of cryptography on a PE-PE basis is for further study."
> Regarding PE-PE IPsec:
> * RSVP over VPN would work just fine (as currently specified) for PE-CE
> links
> * RSVP over VPN would not allow CAC over MPLS Core as we need TE tunnels
> to do that which I believe could not be used with MPLS over IP/IPsec in
> the core.
> Regarding CE-CE IPsec (or if IPsec starts deeper inside the VPN site):
> RFC 4923 "Quality of Service (QoS) Signaling in a Nested Virtual Private
> Network" describes a model for RSVP operation through IPsec Gateways (in
> a nutshell, the idea is that there is effectively a form of hierarchical
> RSVP where an RSVP reservation is made for the IPsec tunnel and then
> individual RSVP reservations are admitted/aggregated over the tunnel
> reservation). This would apply in case to the case of CE-CE IPsec (or if
> IPsec starts deeper inside the VPN site) and the procedures defined in
> the document would simply apply "as is" to the reservation for the
> tunnel(s) (and not to the individual end to end RSVP reservation).
> If this answers your question appropriately, we could add text capturing
> this in the Security Considerations (whenever we issue the next rev).
> Please let us if this works for you.
> Thanks
> Francois
>> *Stefan Santesson
>> *


Magnus Westerlund

IETF Transport Area Director
Multimedia Technologies, Ericsson Research EAB/TVM
Ericsson AB                | Phone  +46 10 7148287
Färögatan 6                | Mobile +46 73 0949079
SE-164 80 Stockholm, Sweden| mailto: