[secdir] secdir review of draft-ietf-homenet-babel-profile-02 (early review, not ready)
Leif Johansson <leifj@sunet.se> Fri, 04 August 2017 08:16 UTC
Return-Path: <leifj@sunet.se>
X-Original-To: secdir@ietfa.amsl.com
Delivered-To: secdir@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3D58B128A32 for <secdir@ietfa.amsl.com>; Fri, 4 Aug 2017 01:16:46 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.601
X-Spam-Level:
X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=sunet-se.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dtMaiemh6HHP for <secdir@ietfa.amsl.com>; Fri, 4 Aug 2017 01:16:43 -0700 (PDT)
Received: from mail-lf0-x231.google.com (mail-lf0-x231.google.com [IPv6:2a00:1450:4010:c07::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 43A65126B6D for <secdir@ietf.org>; Fri, 4 Aug 2017 01:16:42 -0700 (PDT)
Received: by mail-lf0-x231.google.com with SMTP id t128so3978987lff.2 for <secdir@ietf.org>; Fri, 04 Aug 2017 01:16:42 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sunet-se.20150623.gappssmtp.com; s=20150623; h=to:from:subject:message-id:date:user-agent:mime-version :content-language:content-transfer-encoding; bh=eQNiwCHzVkx/2JlKPyYepFkgKmMsqbTut9WuVzCc0dw=; b=uUljhbQ3Fcpu4zG5s5VzTUDhg87izxtij7W/WFTt9iTrGRK2UfOxMeiWNI3QZdBxtk ijTpeBCZSGCol/K2IumyPXQ60Qa29ZQybaIWbZs7SdOUxn+hc+8mKMoch+DqWX4RhRdS /ZakwkfdJjv0mQqybtxmA5DIGhKVW6OzcpEeXkQu+23At85dAJvPRKW9jBAo3tYBULdA a95pnkazfC4iSku60QmrVUYg5lfsOLIN0vihEx0c4ZnD0IL1XgwEpojdgF5J/WEAibmz E4+4Z+qQhQVQLXLkVGAgRqGJoEGFrvEnpf1R8eGZylzzsRFWQiDwJiBJEAH/dynvD2wT lrNA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:to:from:subject:message-id:date:user-agent :mime-version:content-language:content-transfer-encoding; bh=eQNiwCHzVkx/2JlKPyYepFkgKmMsqbTut9WuVzCc0dw=; b=jcGFfv53EOAxUI0C7Xh4pWH8GyuaGccNyzZqmgkdviDpiGuFuJzWHy6lO26J0hsyfN 8fAQG1S4J8YPLTo4rpT3RHVRrL0z9piyXkwCwzH8UNHWZH8NzGpiolRpTnrs/mkFqSzZ Fz4SpYZvd3HB/1a9hUy/MH4TKcLBfdCvAD40iWfgk4TbXaph8NbioZwKlBv9u+sTfW4b Ws5by2nWefRcmIClmk6gdtCZ8qlCf5aVYyzCtK4NM+yrvuqErDwx+5CZMHYax+NeAjMS Lcm7jLUV34cnEzdKYAvSeXm1VZLfOb8vRwbKKq2Ul41pxXUXO6YN243lq/EBqqbvYgd8 i4ZQ==
X-Gm-Message-State: AHYfb5hvY9x7yYlPcNLbH/VDl5VKASzsYJAbaw7T6Phnccy2jFPOK1+P B4n7RCWt6FI/LKV4cOzX+g==
X-Received: by 10.46.32.80 with SMTP id g77mr662113ljg.55.1501834601208; Fri, 04 Aug 2017 01:16:41 -0700 (PDT)
Received: from [192.168.1.72] (81-230-12-165-no206.tbcn.telia.com. [81.230.12.165]) by smtp.gmail.com with ESMTPSA id n72sm838094lje.51.2017.08.04.01.16.40 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 04 Aug 2017 01:16:40 -0700 (PDT)
To: "secdir@ietf.org" <secdir@ietf.org>, draft-ietf-homenet-babel-profile.all@ietf.org, "iesg@ietf.org" <iesg@ietf.org>
From: Leif Johansson <leifj@sunet.se>
Message-ID: <ea48eb52-9af1-ebe6-7f00-7d47d470d7ad@sunet.se>
Date: Fri, 04 Aug 2017 10:16:39 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.2.1
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Language: en-US
Content-Transfer-Encoding: 8bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/secdir/eP71hkr98Bl6sat4cfUwa4IjuGo>
Subject: [secdir] secdir review of draft-ietf-homenet-babel-profile-02 (early review, not ready)
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/secdir/>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 04 Aug 2017 08:16:46 -0000
I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. This is an early review requested by Ray Bellis and so it is to be expected that the document isn't quite ready. The document is clearly written and although I'm not an expert on routing I can follow the requirements with little difficulty. I have primarily reviewed the document with a security focus and I have not gone looking for "nits" to fix. My main problem with the document is the trust model which is based on the notion of "internal" links. In general I think this will turn out to be harder to do in practice. As home networks grow in complexity I suspect this "binary" trust model will fail to accurately map to reality. In fact, RFC7788 lists several other categories (eg Hybrid) and although I suspect this is still a simplistic model, these other categories should be covered in this document. Finally REQ6 sais that implementations SHOULD distinguish between wired and wireless links. It seems to me that this should be a MUST given how important link classification is to the security model and also given that border classification defaults to the internal category. Cheers Leif
- [secdir] secdir review of draft-ietf-homenet-babeā¦ Leif Johansson