[secdir] draft-ietf-nvo3-use-case-15 SECDIR review

[Donald Eastlake <[e-mail]>]

I have reviewed this document as part of the security directorate's ongoing
effort to review all IETF documents being processed by the IESG. Document
editors and WG chairs should treat these comments just like any other last
call comments.

This draft described use cases for network virtualization overlay networks
focusing on Data Center use. I think this document is Ready with issues.

*Security:*

As an Informational use case document, security is not a major focus of
this draft. Nevertheless:

The existing Security Considerations section says that Data Center
operators need to provide tenants with a virtual network that is "isolated
from other tenants' traffic as well as from underlay networks". But I don't
think tenants can, in general, be protected from the underlay network. I
would say that tenants are vulnerable to observation and data
modification/injection by the operator of the underlay and should only use
operators they trust.

The existing Security Considerations section says that tenants need to be
isolated from each other but I believe there will always be covert
channels, based on resource contention and the like, by which tenants can
communicate with each other and the best that can be done is to limit the
bandwidth of such communications.


*Minor:*

"BUM" and "ASBR" used without definition or expansion.

Wording: I think the wording is off in some places for a reader for whom
English is their native language. See attached for suggestions. I probably
haven't caught all the wording glitches.

Thanks,
Donald
===============================
 Donald E. Eastlake 3rd   [phone] (cell)
 155 Beaver Street, Milford, MA 01757 USA
 [e-mail]