Re: [secdir] SECDIR review of draft-ietf- bess-evpn-usage-07

[Alvaro Retana <[e-mail]>]

On February 2, 2018 at 1:16:28 PM, Stephen Kent ([e-mail]) wrote:

Steve:

Hi!  How are you?

...

Section 10 (Security Considerations) consists of only one sentence, which
refers to the corresponding discussion in RFC 7432. Additional text should
be provided here to explain why this document does not add any new security
considerations. Presumably the rationale is that the provisioning model and
initialization procedures described here are a subset of the more general
discussion in 7432 and thus no new security concerns arise as a result of
this more detailed information. I am not in a position to judge whether
that potential rationale is true.

Fair enough.

I reviewed the Security Considerations section of RFC 7432. It contains
about 1.5 pages of text. The first paragraph there cites security
considerations text in RFCs 4761, 4762, and 4364 and the text there is
generally well-written. However, there is a significant omission, one that
should have been noted in the SECDIR review of that document. Specifically,
7432 cites NONE of the BGP security RFCs produced by the SIDR WG (e.g.,
RFCs 6480-93 et al), even though they preceded publication of that RFC.
Since those documents represented the latest proposals for improving BGP
security at the time, they ought to have been cited and a very brief
discussion of their relevance to EVPN BGP MPLS deployments. I suggest that
this document rectify this omission, i.e., cite several of the BGP secure
origin authentication RFCs, and the recent BGPSec RFCs (8205-11), and note
the relevance of those standards to EVPN BGP MPLS deployments.

The work from sidr doesn’t directly apply to EVPN simply because the ROAs
and BGPSec have been specified only for IPv4/IPv6 and not for the Address
Family used by EVPN.

Maybe a statement like that is what you’re looking for — but I don’t think
it is appropriate to go any further in this document.
Thanks!

Alvaro.