IETF Logo Mail Archive

Re: [secdir] SECDIR Review of draft-ietf-pcp-description-option-02

"Reinaldo Penno (repenno)" <repenno@cisco.com> Fri, 15 November 2013 04:25 UTC

Return-Path: <repenno@cisco.com>
X-Original-To: secdir@ietfa.amsl.com
Delivered-To: secdir@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5F48D11E817E for <secdir@ietfa.amsl.com>; Thu, 14 Nov 2013 20:25:02 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -7.999
X-Spam-Level:
X-Spam-Status: No, score=-7.999 tagged_above=-999 required=5 tests=[HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-8]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Q3kxf1XTI1a7 for <secdir@ietfa.amsl.com>; Thu, 14 Nov 2013 20:24:57 -0800 (PST)
Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) by ietfa.amsl.com (Postfix) with ESMTP id 0EC3C11E8177 for <secdir@ietf.org>; Thu, 14 Nov 2013 20:24:57 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=8864; q=dns/txt; s=iport; t=1384489497; x=1385699097; h=from:to:subject:date:message-id:in-reply-to:mime-version; bh=olkfOzxUxN01iUb3xGuvig5J6FRw3e/KY3Mf/gKcHoA=; b=dxx1qZV0B8Rho2IF+hl3DC5exrcrykvVLWrnotiSDEAx8uj4rI06NMsf Cr6ZftTFKV7kmC8qCPG7EoiGJ4pfYG6YTK7k+QGubTy2AAAhUc4+7pDlL zLjfsRQw8sSsIL3+a33g5EY/lkDfbOho+I7G8+4vxB1XSSpaddPjXvKqQ k=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AhIIAG+hhVKtJV2b/2dsb2JhbABZgkNEOFOEFKhniV+IRYEiFnSCJQECBIELAQgRAwECKCgRFAkIAgQBEodvAw8Ntn8NiVOMbYJkDQuEMQOWJYFrgS+LJYU4gyiCKg
X-IronPort-AV: E=Sophos; i="4.93,704,1378857600"; d="scan'208,217"; a="284900328"
Received: from rcdn-core-4.cisco.com ([173.37.93.155]) by rcdn-iport-1.cisco.com with ESMTP; 15 Nov 2013 04:24:35 +0000
Received: from xhc-rcd-x11.cisco.com (xhc-rcd-x11.cisco.com [173.37.183.85]) by rcdn-core-4.cisco.com (8.14.5/8.14.5) with ESMTP id rAF4OZ0H001223 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Fri, 15 Nov 2013 04:24:35 GMT
Received: from xmb-rcd-x04.cisco.com ([169.254.8.192]) by xhc-rcd-x11.cisco.com ([173.37.183.85]) with mapi id 14.03.0123.003; Thu, 14 Nov 2013 22:24:34 -0600
From: "Reinaldo Penno (repenno)" <repenno@cisco.com>
To: Phillip Hallam-Baker <hallam@gmail.com>, "secdir@ietf.org" <secdir@ietf.org>, "draft-ietf-pcp-description-option@tools.ietf.org" <draft-ietf-pcp-description-option@tools.ietf.org>
Thread-Topic: SECDIR Review of draft-ietf-pcp-description-option-02
Thread-Index: AQHO4Z2d3yMYBDQllE2JVi50kvlW4ZolkGiA
Date: Fri, 15 Nov 2013 04:24:34 +0000
Message-ID: <CEAADCA1.602A%repenno@cisco.com>
In-Reply-To: <CAMm+LwgtbcWxLJ6t_12NqOx2tAqMJNAEFc57Pqh=imrH44Fx9A@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
user-agent: Microsoft-MacOutlook/14.2.3.120616
x-originating-ip: [10.21.119.168]
Content-Type: multipart/alternative; boundary="_000_CEAADCA1602Arepennociscocom_"
MIME-Version: 1.0
X-Mailman-Approved-At: Fri, 15 Nov 2013 08:26:07 -0800
Subject: Re: [secdir] SECDIR Review of draft-ietf-pcp-description-option-02
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/secdir>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 15 Nov 2013 04:25:02 -0000

Hello Phillip,

Thanks for the review. Inline with [RP]

From: Phillip Hallam-Baker <hallam@gmail.com<mailto:hallam@gmail.com>>
Date: Thursday, November 14, 2013 4:56 PM
To: "secdir@ietf.org<mailto:secdir@ietf.org>" <secdir@ietf.org<mailto:secdir@ietf.org>>, "draft-ietf-pcp-description-option@tools.ietf.org<mailto:draft-ietf-pcp-description-option@tools.ietf.org>" <draft-ietf-pcp-description-option@tools.ietf.org<mailto:draft-ietf-pcp-description-option@tools.ietf.org>>
Subject: SECDIR Review of draft-ietf-pcp-description-option-02
Resent-From: <draft-alias-bounces@tools.ietf.org<mailto:draft-alias-bounces@tools.ietf.org>>
Resent-To: <dwing@cisco.com<mailto:dwing@cisco.com>>, "mohamed.boucadair@orange.com<mailto:mohamed.boucadair@orange.com>" <mohamed.boucadair@orange.com<mailto:mohamed.boucadair@orange.com>>, Cisco Employee <repenno@cisco.com<mailto:repenno@cisco.com>>
Resent-Date: Thursday, November 14, 2013 4:57 PM

  I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the
security area directors.  Document editors and WG chairs should treat
these comments just like any other last call comments.

The document adds a 'description' option to the PCP protocol. The description does not have defined semantics in PCP. As such the Security Considerations relies on the considerations in the PCP specification.

This seems ill advised to me. Even though the field has no semantics in PCP it is essentially the equivalent of a TXT RR in the DNS, possibly the most over-used and abused RR in the DNS protocol.

If the description option is added then people are going to start using it to define site local semantics unless there is some other mechanism for that purpose.

[RP] Different from DNS a PCP client can not query the description of its mappings.  Can you give me an example of such site local semantics so I can understand better your concern?  I found this:

https://support.google.com/a/answer/2716800?hl=en

But it relies on the fact that DNS clients can query such information.

I suggest that the draft authors either add a description of how to use the PCP mechanisms for this purpose (if applicable) or describe a mechanism to support this use and preferably providing some sort of protection against collisions.

Such a mechanism needs to consider the authenticity of the data provided and the risk that it might disclose data to another application.


--
Website: http://hallambaker.com/

v2.23.0 | Report a Bug | By Email