Re: [secdir] Secdir review of draft-ietf-ospf-rfc6506bis-03

[Acee Lindem <[e-mail]>]

I tend to agree with Manav - this seems to be a rather extreme measure and
wouldn't be used by a router line card simply to prioritize a packet.

Thanks,
Acee

On 12/4/13 8:29 AM, "Bhatia, Manav (Manav)"
<[e-mail]> wrote:

>Hi Brian,
>
>Thanks for the review. I have a comment inline.
>> 
>> But now RFC 5879 ("Heuristics for Detecting ESP-NULL Packets") has been
>> published, which does describe some techniques to deterministically
>> detect an unencrypted ESP packet. It may be still be difficult to
>> prioritize certain OSPFv3 packets, but the justification is no longer
>> precisely accurate. I would suggest something like the following
>> rewording:
>
>The justification still holds good as I don't think we will ever use
>heuristics for detecting ESP-NULL control packets that need to be
>consumed.
>
>Its afaik primarily meant for firewalls that want to deep inspect
>packets. Obviously, there is nothing there in the standard that precludes
>it from being implemented on router's CPU path, but I doubt if we will
>ever go down that path. If this is really required on the routers, then
>WESP (RFC 5840) will probably be the path to go down on -- but that would
>require protocol extensions.
>
>Cheers, Manav
>
>> 
>>    Implementations desiring to prioritize certain OSPFv3 packet types,
>>    e.g., Hello packets, over the other types, often perform the
>>    prioritization prior to decryption. Parsing ESP packets is
>> problematic
>>    when the prioritization code does not know whether the ESP packets
>>    include an encryption algorithm, or are instead ESP-NULL packets
>> [RFC2410].
>>    Techniques exist to identify ESP packets using ESP-NULL packets
>>    [RFC5879], which would allow these packets to be examined  and
>>    prioritized. However, the techniques may not be practically applied
>>    within the prioritization code.
>> 
>> Brian