IETF Logo Mail Archive

[spring] Security aspects of SRv6-based overlay services

Alexander Vainshtein <Alexander.Vainshtein@rbbn.com> Fri, 04 September 2026 07:13 UTC

Return-Path: <alexander.vainshtein@rbbn.com>
X-Original-To: spring@mail2.ietf.org
Delivered-To: spring@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 2310A13549132 for <spring@mail2.ietf.org>; Fri, 4 Sep 2026 00:13:43 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1788506023; bh=q5Pmo8LdxWTfkavqOEjAPF7jGTi+8neTlKAlRxiFkxM=; h=From:To:CC:Subject:Date; b=oTvSrTLFhsLgmtjznLgAEHSzbwcXp4ujGCMoqwk3tDfJ0Yw6lxZKeNptb7j9hQqVu TBbheesRiAwVmUU4+sxVthyLbasFHni5R1dOyGWOnbU4cnFkNddRxqhM5/PvdN9lzi jy/AZJGVb2B1/Ul/rdhl7vYqTuiDu72/PL63moOY=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.096
X-Spam-Level:
X-Spam-Status: No, score=-2.096 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H5=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=rbbn.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XcZ2PkD-CIrz for <spring@mail2.ietf.org>; Fri, 4 Sep 2026 00:13:42 -0700 (PDT)
Received: from usb-smtp-delivery-110.mimecast.com (usb-smtp-delivery-110.mimecast.com [170.10.153.110]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 7CAC41354910F for <spring@ietf.org>; Fri, 4 Sep 2026 00:13:42 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rbbn.com; s=mimecast20240522; t=1788506021; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type; bh=q5Pmo8LdxWTfkavqOEjAPF7jGTi+8neTlKAlRxiFkxM=; b=TXxKgR3nn4ykl1aIJsdMOD/jvAteIDcPgsHPY078tSDUSIRLceIFR9uZr8PXWgg9z22dXb 6OEuqIyfIv474CGfGM2SS+8XD44bOGgaHu8/ry2I00uwut5MAtWzyXuuAthRbVSD0BkZX5 mju8nzzMTmOt1aybntRsDgLMKwnxmUVP2y+WbRZ13u7SbixDiBa2zoiskzQdKiTLzrTPqy EfDagGYKXZWMBaRGV2C3WyZxEZ492gSDacrud3GeRUMwpGlYUCPxRFT+J8xeCHeo+Tgo6s dz+KEPHacx7IH4tOlP3pThBcJZOdMVTl4KCazDvUTB9+T6e0tZNBjFS0OJYQBQ==
Received: from PH0PR06CU001.outbound.protection.outlook.com (mail-westus3azon11021103.outbound.protection.outlook.com [40.107.208.103]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id usb-mta-8-KmuRArh7Nj2J2NI23zwVbw-2; Fri, 04 Sep 2026 00:12:25 -0700
X-MC-Unique: KmuRArh7Nj2J2NI23zwVbw-2
X-Mimecast-MFC-AGG-ID: KmuRArh7Nj2J2NI23zwVbw_1788505944
Received: from PH0PR03MB6300.namprd03.prod.outlook.com (2603:10b6:510:e2::5) by LV8PR03MB7423.namprd03.prod.outlook.com (2603:10b6:408:182::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.11; Fri, 4 Sep 2026 07:12:19 +0000
Received: from PH0PR03MB6300.namprd03.prod.outlook.com ([fe80::6bff:3405:30e9:55d9]) by PH0PR03MB6300.namprd03.prod.outlook.com ([fe80::6bff:3405:30e9:55d9%3]) with mapi id 15.21.0360.008; Fri, 4 Sep 2026 07:12:19 +0000
From: Alexander Vainshtein <Alexander.Vainshtein@rbbn.com>
To: "draft-ietf-spring-srv6-security@ietf.org" <draft-ietf-spring-srv6-security@ietf.org>
Thread-Topic: Security aspects of SRv6-based overlay services
Thread-Index: AQHdPDouHjH6P2I5I0Svbsp2sNaisA==
Date: Fri, 04 Sep 2026 07:12:19 +0000
Message-ID: <PH0PR03MB63006E0208CB4ED3E5D45626F6B52@PH0PR03MB6300.namprd03.prod.outlook.com>
Accept-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-ms-reactions: allow
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: PH0PR03MB6300:EE_|LV8PR03MB7423:EE_
x-ms-office365-filtering-correlation-id: 8ba1fcd1-0e5e-4af7-29b0-08df0a53dbda
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;ARA:13230040|23010399003|366016|376014|1800799024|19092799006|38070700021|10067099003|56012099006|11063799006|8096899003|18002099003
x-microsoft-antispam-message-info: k7uedGicmRKayygbLBx/+zE/1Dp5AkC2HARhzcbUoTBccqHflvPGdho4HVJAZt3P58A+pRZoRZ1bURtqd5TaXzQ5WkHsl5JwYcvJujKPjug2XkAstXddM5u6eOvK0Bi+y87DHpAYAA+OL6GoYFv/p3M5hPy9Q5ASlnXWefxEXaDk3ZJdAHD1k685LmBmW79n8P/vFu4qaVAL9hh/n9tSMybAHyGcrFdqVVP369CK64z5rpQWrJZrZJ5XZYdR6dBDsuGiPpL2XRQIpBSDRqgTcvAWFleH5vcAbZDyeu1uC9qk0tc4TNnnc9Mb5d14TZKl1Hqz4TFsB2RApz7Yuw+iOWFGaoh2ZUywY2uoKx3GipxRUajEztv+1MObMcBxThPx+aSKXlr0HKJSMdFGXtm5RCpep3QZTNZfPL13HzodNpbYIGSNQbpB5qzwvGkjHxEo/EvQDdDbo7+DhzEqYV9EQHAYHFUTTKX1HxM2mYyiEv6rimewWCg3cKQfJH/z7F0n/Eghs8KfJep5zj3ixz7PNuP2ULIhYuL06RUeFs7Avq8cnspr14cv6Ok6a9dAfr28vPLgJdLZTqpfUOFwoF+Y+RWpSbdWC8JwYp+4S4lMWpYgGZO+R6GLfcl0mJtfVNo5Rq6sAwCcGyX5v4uNwnr4dxZ3ta3Pj0HFHSLOUkylhbE=
x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:PH0PR03MB6300.namprd03.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(366016)(376014)(1800799024)(19092799006)(38070700021)(10067099003)(56012099006)(11063799006)(8096899003)(18002099003);DIR:OUT;SFP:1102
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: FF/17ya8Sn0EMyY5X3DqdeqmuyNEFAGstd66vO7OwZKhUf1+t6yZJphPDlasQOHJLqOmhfbYY6jdlTHcTiXdby1Q43dhxppdxCqdpzdCx0yxTsg4xSQGgjfkLFho2PLaJeUZ2iivS6G7Yllo1lfWJvRZho3Pk16qXLvC3un3d0xtGY0+my95gOP/nAnKImwv6KUY67zxU4+qtWY18We1nm7Rh2MQ/CBTmNcbRbwM+xArilifZyokgmOFIjNH8osFwz3cG3hci6D2rp/hG1JypyEtAJ1sZ7MpjkR7byKts+h1DKUpkurQvrf2qmNS/NZmNMVEkJ0Xz2Wr171RIWvD3UaHA7Ggb6M13XGrOHiK/TYJghY+qK48k+sp+WmY5Kv9pF0YP4EPC9poysooC11XSYs8Jm0W+Nul/JLHD+Iu74zk4OI21MiSu1ZpMqZg8NKmkZmZbzdmS6p0xFSQzB+B7MDB4yAUXV0wexB/tGpwsJrlkNeUiLzrNCtVGGJDoMKfiua6DAdv5hfdx//HYA5p0FuONwV+DAgZOJ3FgUmC3bsXhP2elf5fEP1G64jAsbY/v8I6mVOXA9q4+y7apJO6wmWxZPQ2EGDXeeof9YLESnSyIkvseZ2hENOq6pqK1EHWw/33uAT3LGBo1O9dgq6o56Va3Pk8GBGX4F/cVhUVHzOjaudY3rOH6ISUqUpryUIXmvM+TgWPk5L+mRZ0LEoVNN+2Qm30FVwvZaeuVbSJ54dLQKgXm423ngR2LUPV5BcuFy1BbivnYyeS5gjscs8NB9trCOKE28gXTl+bPejrlPntlbIGuDC/A4AOnp/B4DJhuBv41j3V/EJiDASNtC7sJ8Z00wC9jq3xPcEbXIjJ6vS2VSK2MUaZujn6YsbX6rKeT+fV2fp66svJVzZ/aJDE0SQQMxx8erSbDiW56WZkl+xCb+buIyJuCfjHc1b7dblj3mkfpuD4ahaSkQcJay6euXOEJEEK6gzMQZJmG8ys6fk1ibekJE2m+WEGh9RPq1FlSC6Ia+NNoGoljfFp5zfaZNx2WGM+4JYb/IsXYn/XfCZfPUPGAXaq83vZeLK3WiaPjc1scpmPFoz9VpzLeN0cSuQLdlZuQolZaLsOl7IOrzAxFfGCjhHSaKr2NBFZ2SVhJ6Yj26/0Fy7zz8XTPTn/G6WGcMqQ6RGK4wcH6sUFKw8EkZ5fXyhpYaRfhT3SrPZ+yrDIvEVvi+JrOXEq7tzSQse1JfzSDfRwyh12hA3E9/q7quM7oY5sJAlMMwCeJEiEcd6prWZhJEtamD11KOdGRcy+qeCpuEAkoqWQx1VZh2VhON+HdDcGF3pW73ZH+Hl/1+MvjxG9c0GrxSsw9JlY94Hqdj48Vk9R+DY1kF99zoSNAuVTxCLngnf+iB/9HpFTfT2wAmPliOOZUH3eMmE8vZtrxlPYj6O3zBsxr4L8jkU8LKeRF7QMk31RkPyLo92GvL+VOiy/PTuPrw/0SDMyNkf1LpLnnTx9i3/5O3c1l3NDJeprVZv4K3aTvGqq47CHJp+8j5YcgB4IVLYGzQzqo5UXgpNdXA48V3WFxayMpBXu2j3E5QNi7cYdrFrW/f9GPKFpS6UHdap6dO9pRfxR73ZSZ8oyDStxsyCKGGj5FsZTlMJ91E7NTpEF1OUUdOw2oIySGzSBeB0eJswoDWvaQyYm6o4JF59dfbhII0/scqwA3diuz/yVJTnLUlx3hKpdJGUeD58dCZDmncODoKEKhQ==
MIME-Version: 1.0
X-Exchange-RoutingPolicyChecked: tdFnUkVSion89VZ31u4k8iZuc0wLRq22ORYuRU3ypLEnvE/Fi5tuVXineU+t+5TJS02Qr8b1pTnECDAcJwpWIeRxEwCDfKSyfLsYAM3/u6PwMSzrMSeBfJ7F08xCT9cdtk4ESByNUQ3aYvHXVZfAGj/XDWDo8GGC63X4PAzIxX2dVWps3svKBLXWbJhP/LqESbjB2Lu+aJ7rHUWa4VarbvgolKSDyv+sKDdaCvrvK6pI3hyMRIFHHYIrLcjQpWaJyK6XFXVaRtD0FdAgjYkLmSHg8J4SqC80m4DnoXXoytbuHJKjQWKzyXnYGkyShW8WI3j1UbuBauDvCz/GnPMAZQ==
X-OriginatorOrg: rbbn.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: PH0PR03MB6300.namprd03.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 8ba1fcd1-0e5e-4af7-29b0-08df0a53dbda
X-MS-Exchange-CrossTenant-originalarrivaltime: 04 Sep 2026 07:12:19.6703 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 29a671dc-ed7e-4a54-b1e5-8da1eb495dc3
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: udkHCIU5oTyNrkv6WdCQr/dkPd6BOxrxN/5VvXjDnwTk3P4YQtB9ELwlSdlUx9TfJjGen8GbhERPxHWA7gGi2Q==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: LV8PR03MB7423
X-Mimecast-Spam-Score: 0
X-Mimecast-MFC-PROC-ID: Y3HtOSsp3F6_1oQSQ6TDgH5Ni5kXiG7YYZ_xm7oyrZE_1788505944
X-Mimecast-Originator: rbbn.com
Content-Language: en-US
Content-Type: multipart/alternative; boundary="_000_PH0PR03MB63006E0208CB4ED3E5D45626F6B52PH0PR03MB6300namp_"
Message-ID-Hash: P4V4I2LDXUQ5NT34TTN7CYMHNK7SBRCP
X-Message-ID-Hash: P4V4I2LDXUQ5NT34TTN7CYMHNK7SBRCP
X-MailFrom: alexander.vainshtein@rbbn.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-spring.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: "bess@ietf.org" <bess@ietf.org>, "spring@ietf.org" <spring@ietf.org>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [spring] Security aspects of SRv6-based overlay services
List-Id: "Source Packet Routing in NetworkinG (SPRING)" <spring.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/spring/K9CfI5GL28r_BlGgAWwXFR_qsfc>
List-Archive: <https://mailarchive.ietf.org/arch/browse/spring>
List-Help: <mailto:spring-request@ietf.org?subject=help>
List-Owner: <mailto:spring-owner@ietf.org>
List-Post: <mailto:spring@ietf.org>
List-Subscribe: <mailto:spring-join@ietf.org>
List-Unsubscribe: <mailto:spring-leave@ietf.org>

Hi all,
I have briefly looked up the current version of the draft.

I am not a security expert, but it seems that the draft deals with security aspects of SRv6 underlay.
I wonder if SRv6 "service SIDs" and the way they are advertised in BGP do not introduce any special vulnerabilities.

E.g., a compromised Route Reflector could modify (or simply discard) the BGP Prefix SID Attribute in routes of such families as VPN-IP or EVPN - with a devastating effect on the services., while such an attack would not have any impact on IP-VPN and EVPN services over MPLS underlay.

What, if anything, do I miss?

Regards,
Sasha


Get Outlook for Android<https://aka.ms/AAb9ysg>

Disclaimer

This e-mail together with any attachments may contain information of Ribbon Communications Inc. and its Affiliates that is confidential and/or proprietary for the sole use of the intended recipient. Any review, disclosure, reliance or distribution by others or forwarding without express permission is strictly prohibited. If you are not the intended recipient, please notify the sender immediately and then delete all copies, including any attachments.

v2.46.0 | Report a Bug | By Email | System Status