[secdir] Secdir last call review of draft-ietf-sfc-oam-framework

["Konda, Tirumaleswar Reddy" <[e-mail]>]

Reviewer: Tirumaleswar Reddy

Review result: Ready with issues





I reviewed this document as part of the security directorate's ongoing effort to review all IETF documents entering the IESG.  These comments are directed at the security area director(s).  Document editors and WG chairs should treat

these comments like any other last call comments.



This document provides a reference framework for OAM for SFC.



Comments:



1. The document in Section 8 discusses various attacks (including both security and privacy) but does not discuss any protection mechanisms other than proposing rate-limiting.  It is suggesting drafts proposing the OAM solution should address the attacks but I don't see any security

mechanisms discussed in draft-ietf-sfc-ioam-nsh to address the attacks.



2. More discussion is required on the internal attacks.

(a) How are attack packets bypassing SFC detected and blocked ?

(b) How is sensitive information protected from eavesdroppers ?

(c) How is DoS/DDoS attack of misusing the OAM channel is mitigated ?

(d) Rate-limiting blocks both good and bad OAM probes and is a weak mitigation strategy. Anomaly detection (e.g., deep learning techinques) and identifying the attacker look like a better strategy.



Cheers,
-Tiru