Re: [secdir] secdir review of draft-ietf-conex-mobile-05

["Xialiang (Frank)" <[e-mail]>]

Hi Dirk,
Thank you for quick response.
I reviewed the drafts you mentioned below. I agree that they already discussed the general security issues I am concerned, especially in the draft-conex-abstract-mech-13 and its reference.

So, in general, my concerns are addressed. But I still have a little bit doubts about possibly new security issues for the use cases of using ConEx protocol over the mobile communication networks. I am not an expert in this area, can you clarify me?

Thanks!

B.R.
Frank

发件人: Dirk Kutscher [mailto:[e-mail]]
发送时间: 2015年9月11日 16:52
收件人: Xialiang (Frank); secdir; [e-mail]; [e-mail]
主题: RE: secdir review of draft-ietf-conex-mobile-05

Hi Frank,

thanks for the review.

The security issues you mentioned would apply to ConEx in general. The corresponding documents are discussing potential security issues:

https://tools.ietf.org/html/draft-ietf-conex-abstract-mech-13#page-24 (also see the references)
https://tools.ietf.org/html/draft-ietf-conex-destopt-09#page-10
https://tools.ietf.org/html/draft-ietf-conex-tcp-modifications-04#page-11

We’d therefore rather not duplicate that discussion in conex-mobile.

Regarding the security risks you mentioned, I’d say it is questionable whether ConEx introduces additional issues for confidentiality (compared to IP alone).

Thanks,
Dirk



From: Xialiang (Frank) [mailto:[e-mail]]
Sent: Freitag, 11. September 2015 02:49
To: secdir; [e-mail]<mailto:[e-mail]>; [e-mail]<mailto:[e-mail]>
Subject: secdir review of draft-ietf-conex-mobile-05

Hi,
I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written primarily for the benefit of the security area directors.  Document editors and WG chairs should treat these comments just like any other last call comment.

This memo describes a mobile communications use case for congestion exposure (ConEx) with a particular focus on those mobile communication networks that are architecturally similar to the 3GPP Evolved Packet System (EPS).

I have the following comments:

l  1. It should be helpful to consider the communication security between the ConEx senders and receivers such as the Confidentiality, data integrity and peer entity authentication in the security considerations part. Because in general, the corresponding risks are still possible to exist.

l  2. The authentication mechanism among all the elements of ConEx solution should also be considered to handle the condition of faked messages or invalid peer elements.

Recommendation:  Ready With Issues

B.R.
Frank