Re: [TICTOC] Secdir last call review of draft-ietf-tictoc-1588v2-yang-10

[Jiangyuanlong <[e-mail]>]

Ben and Samuel,

Yes, the draft says:" The lowest NETCONF layer is the secure transport layer, and the
   mandatory-to-implement secure transport is Secure Shell (SSH)
   [RFC6242]. The lowest RESTCONF layer is HTTPS, and the mandatory-
   to-implement secure transport is TLS [RFC8446]." Thus authentication is a mandatory part of this layer.
BTW, the security considerations in this draft are fully in accordance with "Guidelines for Authors and Reviewers of YANG Data Model Documents" https://tools.ietf.org/html/draft-ietf-netmod-rfc6087bis-20#page-13 (which is now in RFC Editor Queue), and all future YANG docs developed in the IETF are requested to follow its guidelines).

Thanks,
Yuanlong

> -----Original Message-----
> From: Benjamin Kaduk [mailto:[e-mail]]
> Sent: Thursday, October 04, 2018 10:50 AM
> To: Samuel Weiler
> Cc: [e-mail]; [e-mail]; [e-mail];
> [e-mail]
> Subject: Re: Secdir last call review of draft-ietf-tictoc-1588v2-yang-10
> 
> On Wed, Oct 03, 2018 at 08:18:55AM -0700, Samuel Weiler wrote:
> > Reviewer: Samuel Weiler
> > Review result: Has Issues
> >
> > I wonder whether there should be a requirement to use authentication
> when
> > making updates.  As the doc says:
> 
> The NETCONF and RESTCONF secure transport layers already handle the
> authentication requirements.  E.g., RFC 8040 Section 2.5:
> 
>    The RESTCONF server MUST authenticate client access to any protected
>    resource.  If the RESTCONF client is not authenticated, the server
>    SHOULD send an HTTP response with a "401 Unauthorized" status-line,
>    as defined in Section 3.1 of [RFC7235].  The error-tag value
>    "access-denied" is used in this case.
> 
> But thank you for doing the review, and you're right that this is
> important!
> 
> -Ben
> 
> >    Write operations (e.g., edit-config) to these data nodes without
> >    proper protection can have a negative effect on network operations.
> >
> > I'm sure someone will argue "if this is used in a closed network, we can
> avoid
> > the use of authentication".  Prudence suggests that "closed" networks
> don't
> > remain that way forever, and defense-in-depth is advisable.  Let's add a
> MUST
> > or at least a SHOULD.
> >
> >