Re: [secdir] draft-ietf-nvo3-use-case-15 SECDIR review

Donald Eastlake <> Wed, 04 January 2017 03:50 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 58CCD129BA0; Tue, 3 Jan 2017 19:50:10 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.45
X-Spam-Status: No, score=-2.45 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id nhJlrgoSsc2X; Tue, 3 Jan 2017 19:50:09 -0800 (PST)
Received: from ( [IPv6:2607:f8b0:4001:c06::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id E7440129B8E; Tue, 3 Jan 2017 19:50:08 -0800 (PST)
Received: by with SMTP id p42so446175161ioo.1; Tue, 03 Jan 2017 19:50:08 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=r3mK+prKqxz33CO87frISxTfBN/isdKIcHgNY7rg288=; b=fkHkdkGZmio+BCwhYH+U2EW6kDOy1tgFOyJDlXPHjl7hpGCSdmbcSABMFQKi+I9JOK ZVfosBf6jvkBmpT/Whm4KsLJ0C35eKErt9mTt4x7JzJZtFJV1CA2a2G4QVwVYegNErxA bj/D0IhictRfiDuCD6d9luEV5yaQBcpi+Krr0fykv6WHjazyCxkZvwtn4Ar8CEi8nJWZ Zvf/cqvDjlhBsZ6CrRGnidXi1qwuyVkCZq2qCfwnSD3sqAG+i3j9/CIkZRQv8V/mQ4pp hxJLPltU2Fy7+4KkiyBdrItXmW/srTmEtzdjVgBKAD5E1DSUoHRa/ZS5JN0HBto1u5se 8jNA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=r3mK+prKqxz33CO87frISxTfBN/isdKIcHgNY7rg288=; b=eH/PW15Y603CG04laTU47bRzT3LZURHW5iYBwHv75qvL76g6Yg3bF0PyIYc9RBFcxT 6d0qFbjeb908psRyqkhKZDEzP0XPmmYRTARAhJac4/nrdof17R6wQCm6hWoOXGlHpSDB a67DKV7TogsxFg2FiqTCvrBppxCGEQS6AHw5VO70wGJ990ct27Ayk9x72UcjlEehLWxl Wg/QecXoEoeAWkupDF/b3rUDAQUNLsIzJIOmR/ijLwGKUamj+YqY+F8oT8nTRzdBefRe yYu6YdBc0tlE1LXQOYqbL8DIiIh/u/ooQmqQn45aadjBG5eypQBor8/BMfM+BQv8ncba r2Eg==
X-Gm-Message-State: AIkVDXKeLklNPvaFf+9rUJ90f4sAw4r5lqsX26A8S8Of9hS/Zx1sv+g+ReLQMrv9vnhUED76MzXE88I3xeFffA==
X-Received: by with SMTP id y77mr46975240ioe.12.1483501808196; Tue, 03 Jan 2017 19:50:08 -0800 (PST)
MIME-Version: 1.0
Received: by with HTTP; Tue, 3 Jan 2017 19:49:52 -0800 (PST)
In-Reply-To: <2691CE0099834E4A9C5044EEC662BB9D57B9C24B@dfweml501-mbb>
References: <> <2691CE0099834E4A9C5044EEC662BB9D57B9C24B@dfweml501-mbb>
From: Donald Eastlake <>
Date: Tue, 03 Jan 2017 22:49:52 -0500
Message-ID: <>
To: Lucy yong <>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: <>
Cc: "" <>, "" <>, "" <>
Subject: Re: [secdir] draft-ietf-nvo3-use-case-15 SECDIR review
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Security Area Directorate <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 04 Jan 2017 03:50:10 -0000

Hi Lucy,

On Tue, Jan 3, 2017 at 3:48 PM, Lucy yong <> wrote:
> Hi Donald,
> Thank you for the review.
> From: Donald Eastlake []
> Sent: Tuesday, January 03, 2017 10:15 AM
> To:;
> Cc:
> Subject: draft-ietf-nvo3-use-case-15 SECDIR review
> I have reviewed this document as part of the security directorate's ongoing
> effort to review all IETF documents being processed by the IESG. Document
> editors and WG chairs should treat these comments just like any other last
> call comments.
> This draft described use cases for network virtualization overlay networks
> focusing on Data Center use. I think this document is Ready with issues.
> Security:
> As an Informational use case document, security is not a major focus of this
> draft. Nevertheless:
> The existing Security Considerations section says that Data Center operators
> need to provide tenants with a virtual network that is "isolated from other
> tenants' traffic as well as from underlay networks". But I don't think
> tenants can, in general, be protected from the underlay network. I would say
> that tenants are vulnerable to observation and data modification/injection
> by the operator of the underlay and should only use operators they trust.
> [Lucy] How about: DC operators need to provide a tenant with a secured
> virtual network, which means one tenant’s traffic is isolated from other
> tenants’ traffic and is not leaked to the underlay networks. Tenants are
> vulnerable to observation and data modification/injection by the operator of
> the underlay and should only use operators they trust.


> The existing Security Considerations section says that tenants need to be
> isolated from each other but I believe there will always be covert channels,
> based on resource contention and the like, by which tenants can communicate
> with each other and the best that can be done is to limit the bandwidth of
> such communications.
> [Lucy] suggested text is taken.


> Minor:
> "BUM" and "ASBR" used without definition or expansion.
> [Lucy] ack. Fix some others too.


> Wording: I think the wording is off in some places for a reader for whom
> English is their native language. See attached for suggestions. I probably
> haven't caught all the wording glitches.
> [Lucy] thank very much for the correction.  Should I upload the updated
> version or wait the feedback from other areas?

I would say that you should not update the draft while the IETF Last
Call is running. So you should at least wait until after January 11th.
And in general, after that, you should check with the document
Shepherd (Matthew Bocci) or the AD (Alia Atlas).

 Donald E. Eastlake 3rd   +1-508-333-2270 (cell)
 155 Beaver Street, Milford, MA 01757 USA

> Thanks,
> Lucy
> Thanks,
> Donald
> ===============================
>  Donald E. Eastlake 3rd   +1-508-333-2270 (cell)
>  155 Beaver Street, Milford, MA 01757 USA