Re: [Status] Charter security text

All,

On the topic of MPLS vs IPv6 - one being L2 hence more secure then the
other (L3) I would like to observe that any decently managed network
would already today prohibit to accept any external packets which have
as destination an infrastructure address of such network. That is the
basic protection scheme against DOS/DDOS attacks to the
infrastructure.

When such packet is detected it should be dropped - not "stripped from
explicit routes" like the above charter update would tend to suggest.

As some may recall in the past we have been working on automating such
ACLs installation based in internal IGP addresses on all border
routers under same administrative domain within single AS or number of
ASes to ease operational burden. Not sure if all vendors support such
automation today.

I think what needs to be understood that segment routing is not
internet wide source routing technology. It is carefully crafted path
engineering and packet encapsulation technique within controlled set
of domains which really do not compare to the original issues and
security concerns of source routing.

Best,
R.

On Thu, Oct 10, 2013 at 1:37 PM, Stewart Bryant <stbryant@cisco.com> wrote:
> SPRINGers
>
> In response to a number of IESG blocking comments I have updated
> the security text in the charter to say:
>
> "There is an assumed trust model such that any node
> imposing an explicit route on a packet is assumed to
> be allowed to do so, however administrative and trust
> boundaries may strip explicit routes from a packet.
> For each data plane technology that SPRING specifies,
> a security analysis must be provided showing how protection
> is provided against an attacker disrupting the network by
> maliciously injecting SPRING packets."
>
> I do not know yet whether this has been accepted.
>
> Stewart
> _______________________________________________
> status mailing list
> status@ietf.org
> https://www.ietf.org/mailman/listinfo/status