[secdir] SECDIR review of draft-ietf-l2vpn-pbb-vpls-pe-model

[Phillip Hallam-Baker <[e-mail]>]

I have reviewed this document as part of the security directorate's ongoing
effort to review all IETF documents being processed by the IESG. These
comments were written primarily for the benefit of the security area
directors.  Document editors and WG chairs should treat these comments just
like any other last call comments.


The draft is an informational document describing an architecture for
moving packets about based on MAC addresses.


While the existence of such architectures and devices is likely relevant to
Internet Protocol networking, the draft does not explain how the
architecture described is relevant.

The draft does not contain a substantive Security Considerations, there is
instead a reference:

  No new security issues are introduced beyond those that are described

   in [RFC4761 <http://tools.ietf.org/html/rfc4761>] and [RFC4762
<http://tools.ietf.org/html/rfc4762>].


The references in turn contain references

   A more comprehensive description of the security issues involved in
   L2VPNs is covered in [RFC4111 <http://tools.ietf.org/html/rfc4111>].



This is a pity if the principle purpose of the document is to explain the
differences between IP layer inter-networking and Layer 2 (aka Ethernet
layer) networking and the main differences are in the area of security and
scalability.

One of the main reasons to prefer L2 networking over IP is the dependence
certain LAN protocols still have on the use of broadcast techniques. But
broadcast techniques are by their very nature unscalable. Given n nodes the
cost of broadcast traffic rises as n^2 as every machine on the network has
to process the spam from all the rest.

>From a security point of view the L2 approach results in a true peered
network which has unfortunate effects on security. Absent mechanisms to
authenticate network control messages, every additional machine added to
the network is an additional potential point of pollution.





-- 
Website: http://hallambaker.com/