Re: [secdir] Secdir last call review of draft-ietf-isis-segment-routing-msd-16

"Les Ginsberg (ginsberg)" <ginsberg@cisco.com> Wed, 26 September 2018 22:59 UTC

Return-Path: <ginsberg@cisco.com>
X-Original-To: secdir@ietfa.amsl.com
Delivered-To: secdir@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D61AB128CB7; Wed, 26 Sep 2018 15:59:55 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -14.502
X-Spam-Level:
X-Spam-Status: No, score=-14.502 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rxau0CLWGkUs; Wed, 26 Sep 2018 15:59:53 -0700 (PDT)
Received: from alln-iport-2.cisco.com (alln-iport-2.cisco.com [173.37.142.89]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2B0F9128A6E; Wed, 26 Sep 2018 15:59:53 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=10374; q=dns/txt; s=iport; t=1538002793; x=1539212393; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=Cv+WucbAkB5/cgkhE1OneRZGFea6HfPT84JVK128uPc=; b=jN/dbvVR8oCoPx7vTiV8NXXkSMjpzwWRhp+ZqrV9ygDLcrZDj1TaU6dz 8rxcQeiV7f7kGZGiLPgLiE/gIpOAznvAkC9UkPJ3YTvaKLCIYeNfCuZRo dSEUg1VD4b6mZyF64LsF0QKY68n78aUmQq0lihG25UqjjxSqnu+1noaF2 0=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: A0AMAABnDqxb/49dJa1aDgsBAQEBAQEBAQEBAQEHAQEBAQEBgVGCDoFkKAqDaogVjDCCDYM9kxKBeguEbAIXg2YhNBgBAwEBAgEBAm0ohTgBAQEBAyMRNw4MBAIBCBEEAQEBAgImAgICMBUICAIEDgUIhRukCYEuiheBC4lwF4FBP4ERAYMShRUPgluCVwKTY4kkCQKQIx+BRoRSgweGFZRqAhEUgSUdOIFVcBWDJ4IlF41eOm+MMYEeAQE
X-IronPort-AV: E=Sophos;i="5.54,308,1534809600"; d="scan'208";a="177229998"
Received: from rcdn-core-7.cisco.com ([173.37.93.143]) by alln-iport-2.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 26 Sep 2018 22:59:52 +0000
Received: from XCH-RCD-002.cisco.com (xch-rcd-002.cisco.com [173.37.102.12]) by rcdn-core-7.cisco.com (8.15.2/8.15.2) with ESMTPS id w8QMxpbw022748 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Wed, 26 Sep 2018 22:59:52 GMT
Received: from xch-aln-001.cisco.com (173.36.7.11) by XCH-RCD-002.cisco.com (173.37.102.12) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Wed, 26 Sep 2018 17:59:51 -0500
Received: from xch-aln-001.cisco.com ([173.36.7.11]) by XCH-ALN-001.cisco.com ([173.36.7.11]) with mapi id 15.00.1395.000; Wed, 26 Sep 2018 17:59:50 -0500
From: "Les Ginsberg (ginsberg)" <ginsberg@cisco.com>
To: Benjamin Kaduk <kaduk@mit.edu>
CC: David Waltermire <david.waltermire@nist.gov>, "secdir@ietf.org" <secdir@ietf.org>, "lsr@ietf.org" <lsr@ietf.org>, "ietf@ietf.org" <ietf@ietf.org>, "draft-ietf-isis-segment-routing-msd.all@ietf.org" <draft-ietf-isis-segment-routing-msd.all@ietf.org>
Thread-Topic: Secdir last call review of draft-ietf-isis-segment-routing-msd-16
Thread-Index: AQHUVQPqnQ0QGOOP8EOqsf/gazaoC6UC9FjAgABwTwD//8fJ0A==
Date: Wed, 26 Sep 2018 22:59:50 +0000
Message-ID: <149d5d345afc462f9c5e5770079aaf0e@XCH-ALN-001.cisco.com>
References: <153790283647.5258.15634056350853857580@ietfa.amsl.com> <a3e1e6216dbc46db8c717d5dd2946ea0@XCH-ALN-001.cisco.com> <20180926211104.GQ24695@kduck.kaduk.org>
In-Reply-To: <20180926211104.GQ24695@kduck.kaduk.org>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-ms-exchange-transport-fromentityheader: Hosted
x-originating-ip: [10.24.8.175]
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-Outbound-SMTP-Client: 173.37.102.12, xch-rcd-002.cisco.com
X-Outbound-Node: rcdn-core-7.cisco.com
Archived-At: <https://mailarchive.ietf.org/arch/msg/secdir/vLXQ5FnG6-fOhRAHMm4Q3cckjHc>
Subject: Re: [secdir] Secdir last call review of draft-ietf-isis-segment-routing-msd-16
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/secdir/>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 26 Sep 2018 22:59:56 -0000

Benjamin -

Responses nline.

> -----Original Message-----
> From: Benjamin Kaduk <kaduk@mit.edu>
> Sent: Wednesday, September 26, 2018 2:11 PM
> To: Les Ginsberg (ginsberg) <ginsberg@cisco.com>
> Cc: David Waltermire <david.waltermire@nist.gov>; secdir@ietf.org;
> lsr@ietf.org; ietf@ietf.org; draft-ietf-isis-segment-routing-msd.all@ietf.org
> Subject: Re: Secdir last call review of draft-ietf-isis-segment-routing-msd-16
> 
> On Wed, Sep 26, 2018 at 08:45:03PM +0000, Les Ginsberg (ginsberg) wrote:
> > David -
> >
> > Thanx for the review.
> > A new version of the draft (17) has been published to address your
> comments - subject to my responses below.
> 
> Just in time for me to see the updated version for my IESG review; thanks.
> 
> > > -----Original Message-----
> > > From: David Waltermire <david.waltermire@nist.gov>
> > > Sent: Tuesday, September 25, 2018 12:14 PM
> > > To: secdir@ietf.org
> > > Cc: lsr@ietf.org; ietf@ietf.org; draft-ietf-isis-segment-routing-
> > > msd.all@ietf.org
> > > Subject: Secdir last call review of
> > > draft-ietf-isis-segment-routing-msd-16
> > >
> > > Reviewer: David Waltermire
> > > Review result: Has Issues
> > >
> > > I have reviewed this document as part of the security directorate's
> > > ongoing effort to review all IETF documents being processed by the
> > > IESG.  These comments were written primarily for the benefit of the
> > > security area directors.
> > >  Document editors and WG chairs should treat these comments just
> > > like any other last call comments.
> > >
> > > The summary of the review is Ready with (minor) issues
> > >
> > > My apologies for the late review on this draft. Overall I found this
> > > document to be well-written, and concise.
> > >
> > > General Comments:
> > >
> > > This document uses a mix of case around RFC2119 language (e.g., MAY
> may).
> > > You should use text from RFC8174 to indicate that lowercase versions
> > > of the keywords are not normative, or adjust the case of the
> > > lowercase words to ensure there is no confusion.
> > >
> > [Les:] Section 1.2 does include the standard boilerplate for RFC
> 2119/RFC8174.
> >
> > I checked all the lower case uses of "may" and they are intentional.
> > There was one instance of "should" that I changed to uppercase.
> >
> > > Minor nit: There is some inconsistency in the use of "MSD-Type" (the
> > > value) and "MSD type" (the concept). Suggest cleaning this up.
> > >
> > [Les:] Done
> >
> > > Specific comments:
> > >
> > > Section 1:
> > >
> > > Para 1: s/to insure/to ensure/
> >
> > [Les:] Done.
> >
> > >
> > > Section 4:
> > >
> > > The last paragraph establishes a requirement on the registration of
> > > an MSD Type to define what the absence of a given MSD Type means.
> > > This is an important requirement that must be addressed during
> > > registration of new MSD Types. IMHO, this requirement should be
> > > echoed in the registration information in section 6 to make sure it is not
> overlooked.
> > >
> > [Les:] I disagree. Section 6 is defining exactly what should go into the new
> IANA registry.
> > The definition of "absence" is something that will have to be provided in
> the documents which define new MSD-types, but that will NOT be captured
> in the registry so including this in Section 6 isn’t appropriate.
> 
> I think a good way to think about this is as giving guidance to the Experts, that
> they should not approve registration requests that fail to provide this
> information along with the request.  Guidance for the Experts is appropriate
> in the IANA Considerations section.
> (Also, my understanding is that IANA prefers to have a more explicit
> template for new registrations to follow, though I should not try to speak for
> them.)
> 

[Les:] The reason we use "experts" is because we know/expect them to be familiar with the documents which define the TLVs (unlike a "general IETF reader" whose familiarity with the subject matter may vary).
Repeating what is said in Section 4 in Section 6 only makes sense if you think the "expert" only reads IANA sections. Such a person would not be an expert IMO. :-)

   Les

> >
> > > Section 6:
> > >
> > > The "Base MPLS Imposition MSD" should reference section 5 of this
> > > document.
> >
> > [Les:] Again - Section 6 is defining what will go into the registry. The registry
> will reference the document - not a specific section of the document.
> 
> The contents of the "Reference" column for Value 1 can refer to a specific
> section of a document, surely?
> 
> > >
> > > The registration for "Experimental" should be marked as "Reserved
> > > for Experimental Use" or just "Experimental Use" to align with
> > > RFC8126. RFC8126 states that "it is not appropriate for documents to
> > > select explicit values from registries or ranges with this policy".
> > > It might be good to add a note alongside the one on "Designated
> > > Experts" indicating that values from this range are not assignable.
> > >
> > [Les:] I have changed the text to "Experimental Use".
> > I think the rest of your comment is addressed by RFC 8126 - which is
> referenced.
> >
> > > The "Interior Gateway Protocol (IGP) Parameters" registry has the
> > > "Standards Action" policy assigned. The new "IGP MSD Types"
> > > sub-registry does not have the "Standards Action" policy. Was this
> > > intentional? If so, this should be explained. This is also confusing
> > > since the guidance for expert reviewers in
> > > RFC7370 implies that registrations are based on the "RFC Required"
> > > or "Standards Action" policies.
> > >
> > [Les:] IS-IS registries are typically Expert Review. This derives from
> considerations related to the liason with ISO JTC 1/SC6 (RFC 3563).
> > OSPF registries are typically Standards Action.
> >
> > As IGP Parameters was defined by draft-ietf-ospf-segment-routing-
> extensions, it is Standards Action.
> > But as MSD-Types is being defined in an IS-IS draft...
> >
> > Please learn to live with this.
> > It isn’t a significant issue in my view.
> >
> >
> >
> > > Section 7:
> > >
> > > The security considerations in RFC7981 ask that security
> > > considerations around the disclosure and modification of this type
> > > of information is described in extensions. This has been done, but
> > > RFC7981 also asks that an integrity mechanism be provided if there
> > > is a high risk resulting from modification of capability
> > > information. There is no discussion in the document's security
> > > consideration about the nature of risk in this case and why an
> > > integrity mechanism is not needed. It seems like false information
> > > can be used to cause a denial of service regarding computed paths.
> > > This sounds like having this happen could be bad. I am not an expert on
> routing protocols, so I am not sure if this is an issue. How bad and likely is
> such a risk?
> > >
> >
> > [Les:] The integrity mechanism is (as you point out) discussed in the
> Security section of RFC 7981 - which is referenced in the Security Section of
> this document.
> > The introduction of a new TLV does not alter the integrity mechanism
> requirements.
> 
> My read of 7981 is that "there are these existing integrity protection
> mechanisms; when the consequences of modification are bad, use them".
> So there is not necessarily a need for each TLV to provide its own internal
> integrity scheme, as Les notes.
> 
> -Benjamin