Re: [secdir] Secdir review of draft-ietf-ospf-rfc6506bis-03

[Brian Weis <[e-mail]>]

Hi Acee & Manav,

On Dec 4, 2013, at 10:22 AM, Acee Lindem <[e-mail]> wrote:

> I tend to agree with Manav - this seems to be a rather extreme measure and
> wouldn't be used by a router line card simply to prioritize a packet.

Agreed, but the current text essentially says "you can't do that', but in fact "you can do that but it's too much work to do on the router line card". I was suggesting you say that instead.

Thanks,
Brian

> 
> Thanks,
> Acee
> 
> On 12/4/13 8:29 AM, "Bhatia, Manav (Manav)"
> <[e-mail]> wrote:
> 
>> Hi Brian,
>> 
>> Thanks for the review. I have a comment inline.
>>> 
>>> But now RFC 5879 ("Heuristics for Detecting ESP-NULL Packets") has been
>>> published, which does describe some techniques to deterministically
>>> detect an unencrypted ESP packet. It may be still be difficult to
>>> prioritize certain OSPFv3 packets, but the justification is no longer
>>> precisely accurate. I would suggest something like the following
>>> rewording:
>> 
>> The justification still holds good as I don't think we will ever use
>> heuristics for detecting ESP-NULL control packets that need to be
>> consumed.
>> 
>> Its afaik primarily meant for firewalls that want to deep inspect
>> packets. Obviously, there is nothing there in the standard that precludes
>> it from being implemented on router's CPU path, but I doubt if we will
>> ever go down that path. If this is really required on the routers, then
>> WESP (RFC 5840) will probably be the path to go down on -- but that would
>> require protocol extensions.
>> 
>> Cheers, Manav
>> 
>>> 
>>>   Implementations desiring to prioritize certain OSPFv3 packet types,
>>>   e.g., Hello packets, over the other types, often perform the
>>>   prioritization prior to decryption. Parsing ESP packets is
>>> problematic
>>>   when the prioritization code does not know whether the ESP packets
>>>   include an encryption algorithm, or are instead ESP-NULL packets
>>> [RFC2410].
>>>   Techniques exist to identify ESP packets using ESP-NULL packets
>>>   [RFC5879], which would allow these packets to be examined  and
>>>   prioritized. However, the techniques may not be practically applied
>>>   within the prioritization code.
>>> 
>>> Brian
> 

-- 
Brian Weis
Security, Enterprise Networking Group, Cisco Systems
Telephone: [phone]
Email: [e-mail]