Re: [secdir] New Routing Area Security Design Team

Hi Richard,

Thanks for the mail-

I see Acee has already answered – as he says – the first step is to nail down what are the real security considerations vs. the blanket over top “No new security considerations introduced”.

We all know there is a significant time window for deployment of any new capability. There are many dependencies, vendors not supporting, operators not giving priority. And the “big one”, it is very difficult for an operator to upgrade if everything is working fine today because we all know at least one upgrade claiming to be failsafe which went wrong. We can write MOPs/simulate/test all day long, but the folks “pushing the button” into production are the ones with the nervous breakdowns.

We tried with KARP to improve, but it was very difficult. With this team, we want to review “what are the use cases/threat models”, “what should be the security considerations”. The target is to understand where we can improve - have we (IETF) made a smooth transition operationally possible? Are there gaps – security or operationally which would help deployments? We’ve already discussed with the Security ADs and OPS ADs – and they are ready to support us  – hopefully this time we can do better.

As you say – we need more than RFCs if we are to raise awareness/support deployment. All possibilities are on the table.

Deborah

From: Richard Barnes [mailto:rlb@ipv.sx]
Sent: Friday, April 13, 2018 4:21 PM
To: BRUNGARD, DEBORAH A <db3546@att.com>
Cc: secdir@ietf.org; russ@riw.us; Jeffrey Haas (jhaas@pfrc.org) <jhaas@pfrc.org>; Stewart Bryant (stewart.bryant@gmail.com) <stewart.bryant@gmail.com>; Acee Lindem (acee) (acee@cisco.com) <acee@cisco.com>
Subject: Re: [secdir] New Routing Area Security Design Team

(trimming the CC list a bit)

Hey Deborah,

Delighted to hear this news.  Do you have an idea of what the initial deliverables are for this group?  What security problems are they going to try to address?

TBH, it seems like the headline problem at the Internet level is BGP abuse.  The base RPKI docs have been out for several years now, and BGPSEC is pretty much finished, but the deployment numbers continue to hover around 8-9% for even the most basic protections.  It would be delightful to have a group take a look at what the deployment blockers are here, and whether there's anything the IETF could do to help, whether it's updating protocols, producing deployment guides, writing code, etc.  We shouldn't think that RFCs are the only tool in our arsenal.

Thanks,
--Richard

[1] https://rpki-monitor.antd.nist.gov/<https://urldefense.proofpoint.com/v2/url?u=https-3A__rpki-2Dmonitor.antd.nist.gov_&d=DwMFaQ&c=LFYZ-o9_HUMeMTSQicvjIg&r=6UhGpW9lwi9dM7jYlxXD8w&m=tJd-krV2J7BY160mJ7Ah0N53NG9EJ5NqiloCxwpXjwM&s=DmpDQL8wLFsXb6ByqzKOGVWuxdLtC8B0c9ojbL153rs&e=>

On Fri, Apr 13, 2018 at 4:11 PM, BRUNGARD, DEBORAH A <db3546@att.com<mailto:db3546@att.com>> wrote:
The Routing ADs have chartered a design team as described below.

I will be the AD-contact: db3546@att.com<mailto:db3546@att.com>

Routing Area Security Design Team Charter

Internet security threats have evolved in the last couple of years and questions are arising about the security properties of many long-standing IETF routing protocols and new protocols under development. This is an opportunity for the Routing Area to evaluate current assumptions and make recommendations for new work.

The Routing Area will kick off a Routing Area-wide Design team with support from the OPS Area and Security Area. The first phase will consist of a small team:

Stewart Bryant stewart.bryant@gmail.com<mailto:stewart.bryant@gmail.com>
Jeff Haas jhaas@pfrc.org<mailto:jhaas@pfrc.org>
Acee Lindem acee@cisco.com<mailto:acee@cisco.com>
Russ White russ@riw.us<mailto:russ@riw.us>

They will be responsible to set up an environment (e..g. wiki), identify work items, and coordinating overall the work effort. It is the expectation this initial phase will be done by May 1. A second phase will consist of small teams working on targeted items. Work items will include review of current deployments (use models) and threat models, evaluation criteria and useful advice when doing new work (on existing protocols and new protocols), and recommendations on where new work is needed in cooperation with the responsible working group. The work will have support from the Security Area and OPS Area.

The design team will have a private mailing list for this first phase and can be reached at rt-dt-security@ietf.org<mailto:rt-dt-security@ietf.org>.

Regards,
Deborah

_______________________________________________
secdir mailing list
secdir@ietf.org<mailto:secdir@ietf.org>
https://www.ietf.org/mailman/listinfo/secdir<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_secdir&d=DwMFaQ&c=LFYZ-o9_HUMeMTSQicvjIg&r=6UhGpW9lwi9dM7jYlxXD8w&m=tJd-krV2J7BY160mJ7Ah0N53NG9EJ5NqiloCxwpXjwM&s=9OVVpttOvj6EVHn34P-MjYobNZc1qm8pK4pRHrc0xdQ&e=>
wiki: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview<https://urldefense.proofpoint.com/v2/url?u=http-3A__tools.ietf.org_area_sec_trac_wiki_SecDirReview&d=DwMFaQ&c=LFYZ-o9_HUMeMTSQicvjIg&r=6UhGpW9lwi9dM7jYlxXD8w&m=tJd-krV2J7BY160mJ7Ah0N53NG9EJ5NqiloCxwpXjwM&s=e1mX6z7DgaSk5RLu624MyPPCt4lyKp_5S2Q4B8R_R9U&e=>