Re: [secdir] Secdir last call review of draft-ietf-rift-applicability-14

[Watson Ladd <[e-mail]>]

On Thu, Apr 18, 2024 at 12:18 PM Antoni Przygienda <[e-mail]> wrote:
>
> Hmm, surprising comment a bit …
>
> RIFT draft has a serious security section in 6.9 and a serious security considerations sections in section 9 and IMO it belongs there. AFAIS those section cover extensively security models possible and all kind of threats/consdierations on secure implementations. Of course lots of that could be moved into applicability (should it? Is security “applicability” even and if so, which part of it? Guide how to deploy it securely? ) but I don’t think that’s the intention and I’m bits lost further what “specificity” means here specifically ;-)  e.g.   Key management considerations do not seem particularly specific to rift as a protocol AFAIS  unless what is desired is some RFC reference that describes key management in routing protocols and the pluses/minuses .

As an example of the kind of interaction I'm thinking about RIFT says
"use one symmetric key for ZRT". The applicability document seems (and
maybe I'm wrong in this) to have VMs directly participate in the
fabric for mobility. That means all VMs have the symmetric key. You
probably don't want that.

Sincerely,
Watson Ladd