Re: [secdir] New Routing Area Security Design Team

On Sun, Apr 22, 2018 at 6:17 PM, Christian Huitema <huitema@huitema.net>
wrote:

> On 4/22/2018 2:57 PM, Jeffrey Haas wrote:
>
> > As I point out in my slides, a significant part of this headache is an
> ecosystem issue.  I write mostly BGP related software as part of my day
> job.  I'm aware of better security practices.  I don't control the TCP/IP
> stack I get to use - and these things are not implemented in our routing
> suite.  Yelling at me to have better security at those layers is a NOP; at
> best I pass them back up to product managers to get it done in the people
> who manage those layers.**
>
> That's actually part of the secure transport selection problem. TCP-MD5
> and TCP-AO are not used a lot outside of BGP. They may be standardized,
> but they are not really "mainline". And as such, you may or may not find
> it available in your OS of choice. And as you write, as BGP developer
> you have little control over that. Mainline applications are content
> with TLS, but that won't solve the TCP-RST issue that you are concerned
> about. IPSEC will solve it, but at the cost of interesting management
> issues. I really wonder whether the practical solution might be to
> standardize on a transport like QUIC that runs over UDP. Of course, QUIC
> is not really mainline, at least not yet. But the code can be compiled
> with the application, independently of the OS. So as a BGP developer,
> you could just ship it with your code. You would in fact control the
> transport stack that you use.
>

This seems like a really useful analysis approach.  The bias in this work
should be toward transport protocols that other apps use -- since in the
context we're talking about here, routing is just another application.  So
we should start with the default, mainline protocols (TLS, IPsec), and look
at where they don't fit.

In otherwords: I would prefer to see this group not have as a goal
"Universal deployment of TCP-[MD5|AO]", but rather "Removal of custom hacks
from the ecosystem and replacement by a more mainline protocol".   Let's
bring routing protocols into the applications fold to the greatest degree
possible.

--Richard

>
> -- Christian Huitema
>
> _______________________________________________
> secdir mailing list
> secdir@ietf.org
> https://www.ietf.org/mailman/listinfo/secdir
> wiki: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview
>