Re: [secdir] Review of draft-ietf-ccamp-wson-impairments-07

[Nico Williams <[e-mail]>]

On Wed, Oct 12, 2011 at 12:30 PM, Leeyoung <[e-mail]> wrote:
> Modified security section reads:
>
>   This document discusses a number of control plane architectures that
>   incorporate knowledge of impairments in optical networks. If such
>   architecture is put into use within a network it will by its nature
>   contain details of the physical characteristics of an optical
>   network. Such information would need to be protected from intentional
>   or unintentional disclosure similar to other network information used
>   within intra-domain protocols.
>
>   This document does not require changes to the security models within
>   GMPLS and associated protocols.  That is, the OSPF-TE, RSVP-TE, and
>   PCEP security models could be operated unchanged. However, satisfying
>   the requirements for impairment information dissemination using the existing
>   protocols may significantly affect the loading of those protocols.
>   This may make the operation of the network more vulnerable to denial-
>   of-service attacks or active attacks.  Therefore, additional care maybe
>   required to ensure that the protocols are secure in the impairment-aware
>   WSON environment.
>
>   Furthermore, the additional information distributed in order to
>   address impairment information represents a disclosure of network
>   capabilities that an operator may wish to keep private. Consideration
>   should be given to securing this information.  For a general discussion
>   on MPLS- and GMPLS-related security issues, see the MPLS/GMPLS security
>   framework [RFC5920].
>
> Please suggest some texts if these are not satisfactory to your need. Thanks.

I'm not concerned about denial of service attacks in particular as it
is often the case that there are denial of service attack surfaces
about which there's little we can do.  What I'm concerned about is
whether the framework can handle active attacks such as injections,
impersonation, and MITMs.  The reference to OSPF and friends is
probably sufficient in this regard for me to figure out an answer,
though saying something to the effect that a) you rely on such
protocols for security (your proposed change says so), and b) that
those protocols meet whatever you think the requirements ought to be
for IA-RWA.  Oh, and I suppose you should c) list what you think those
requirements are.  Of course, if these protocols don't today meet
those requirements, then that'd be a problem, but I suspect that won't
prove to be the case.

This is one of those occasions where it's good to ask "what's your
threat model" too.  My guess is that there isn't that much of a threat
from eavesdropping on IA-RWA, so passive attackers are not part of the
threat model.  What active attacks might be in the threat model?

Nico
--